After upgrading few weeks back from SRM 3.5 to 3.6 we are facing issue with alert configuration. Although we are receiving alerts but it seems parameters are missing from alerts we receive through email. We have tried everything to figure this out. Moreover, emc engineers had have hard time to find out the reason behind it. Please help .Here is an example:
Sent: 23 December 2015 09:36
To: UK IT
Subject: Sev-PROP.'severity' PROP.'category' alert received for FileServer-VNX_1683_RHL is now PROP.'eventstate'
An PROP.'eventstate' alert has been received with the following attributes:
Device Type: FileServer
Source IP: PROP.'sourceip'
Part Type: Storage Pool
Part: File NAS - SILVER Pool 4
This is an auto-generated email. To change the notification settings, consult the site administrator.
I have gone through all the product documentation and alerting feature notes but failed to get this configure in a correct manner. Please assist.
I have the same problem with my 3.7 environment. We recently upgraded to 3.7 after originally deploying 3.6 and we never had the time to fully configure alerting. Now I'm circling back and trying to get that up and running properly and I haven't yet been able to get one alert to populate the data properly from the default e-mail template. I really just noticed how bad it was yesterday and haven't yet opened a case with Support but I plan to today. I'll keep you posted if I find anything out.
Please query the events table as stated above. The email which you receive from SRM will pull the properties from genericevents_live table.
I think you added email field directly to default alert templates. For few alerts properties like severity, category etc are not applicable. The best way is to just enable email option for Alert Consolidation Adapter and remove the email option that is added manually for default alert templates.
In future versions there are many enhancements to alerting.
Simply, the template is looking for property that does not exist for that event.
I am running SRM 3.7 and I can not find an alert definition that contains a definition exactly like yours. I do see some close.
Unless you are on a different version or modified the param-list message key.
What I do notice is that I don't think that there should be a property that exists called Source --- it should be source all lower case: "Source: PROP.'Source'"
No magic the property just needs to exist.
Emails should be configured through alert consolidation adapter - Email notification. If there is any email component in the default alert component like -> EMC VMAX, VNX etc, few alert properties might not appear properly in email/snmp traps etc.
The best way is to leave the default alert templates as it is, just edit the SNMP address to Primary backend or localhost(default), so that all the templates will forward the alerts and send it to SRM PBE. Those alerts will be formatted correctly and displayed on SRM UI (All Alerts). Through alert consolidation adapter all these alerts can be emailed or sent to SNMP receiver.
If you want to check the properties you can query the events table directly :
1. Login to Primary Backend
username = root
database = events
password = watch4net
3. Based on the email that is posted above, you can use this query : select device,source,severity,sourceip from genericevents_live where device='VNX_1683_RHL';
If this table has data then it should appear in the email/snmp traps. If you are facing any issue you can contact support or post your query here.. I would be happy to help you.
Thanks for getting back. I am no expert in linux. Could you assist me what commnad i have to execute after entering the mysql db
This is the mysql query that Gnan has suggested to run:
mysql> select device,source,severity,sourceip from genericevents_live where device='VNX_1683_RHL';
Another way is try to add the following to alert email to see which and how much information you can get. You may bot get all of them as this looks like a full list to cover different categories:
you need to format the message body like this:
Opened at: PROP.'OpenedAt'
One thing that I have seen in our environment that is similar to this had to do with the order in which the variable names are specified in the actual alert definition that is triggering the mail consolidation adapter. In the ViPR SRM webUI "All Alerts" page, do the appropriate columns get populated with information? Or, do you see similarly see the columns in the Alert report showing variable names? If this is the case, then what I have found is that the primary alert definition (the one that sends an SNMP trap to the Primary Backend on port 2041) has somehow gotten things out of order. I think in our case it was old alert definitions from SRM 3.0 or something. It took a little work, but I was able to rearrange the order of the variables in that alert definition to get things working properly.
Something to look at anyway.