14 Replies Latest reply on Dec 4, 2018 2:40 PM by Steve Robinson

    PATROL- LOGErrorLvl

      Share:|

      I created configuration of the log km to show me alert if it recognizes specific string with the following options:

      Knowledge Module Command-> Modify -> Default Settings,

      Knowledge Module Command-> Modify -> Search Criteria.

       

      Now I get the alerts from the Patrol:

      "NOTIFY_EVENT Message: <the message that I have configured>"

      And also the following alert from the patrol:

      "Alarm #2 of global parameter 'LOGErrorLvl' triggered on <Log Instance name>"

       

      Can I get only the custom message, and cancel the alert from the LOGErrorLvl parameter (the second alert that I have mentioned)?

       

      In the PDF "BMC PATROL Knowledge Module for log management user guide", under the explanation of the LOGErrorLvl parameter, there is a warning saying: "Do not change the default thresholds of this parameter. Doing so prevents the KM from functioning correctly".

       

      I am trying to filter all of my alerts so we will be able to monitor only few specific alerts from the patrol.

       

      Thank you!

        • 1. Re: PATROL- LOGErrorLvl
          Garland Smith

          Hello Gal,

           

           

           

          The NOTIFY_EVENT is generated based on the LOGErrorLvl event.  If the

          LOGErrorLvl

           

          event were not generated, there would be no related NOTIFY_EVENT.  The

          NOTIFY_EVENT

           

          is based on PKM for Event Management Recovery action executed based on

          Notification

           

          Command defined for the Standard Event 11 generated when LOGErrorLvl goes

          into WARN

           

          or ALARM.

           

           

           

          Regards,

           

          Garland Smith

          • 2. Re: PATROL- LOGErrorLvl

            If you are feeding into BPPM you should see one event, if not which event do you want to keep, and what and how are you feeding your patrol events?

             

            Sent from my iPhone

            • 3. Re: PATROL- LOGErrorLvl

              If memory serves me right the LOGErrorLvl event triggers the notify event.

              Changing the thresholds for LOGErrorLvl would leave you without any event so it is Both or none…

               

              /Marcus

              1 of 1 people found this helpful
              • 4. Re: PATROL- LOGErrorLvl

                Hi Jonathan Coop,

                I want to keep the alerts:

                "NOTIFY_EVENT Message: <the message that I have configured>"

                But now I'm a bit confuse about the answers, everyone says different things...

                • 5. Re: PATROL- LOGErrorLvl
                  Garland Smith

                  On the PATROL side, LOGErrorLvl is the base event off which the NOTIFY_EVENT

                  is generated if you're using

                   

                  PKM for Event Management.  There is no way to prevent the LOGErrorLvl event

                  from being generated.  Without

                   

                  this event, there would be no associated NOTIFY_EVENT.

                   

                   

                   

                  If you're using a Notification Server, only the NOTIFY_EVENTS are forwarded

                  to the Notification Server.  So if

                   

                  you use the Notification Server to integrate with BPPM, only the

                  NOTIFY_EVENTS will be forwarded to the

                   

                  Impact Manager Cell.

                   

                   

                   

                  With newer versions of PatrolAgent and direct integration (i.e. not going

                  through BII4P), there may be some

                   

                  filtering that can be used to send only NOTIFY_EVENT events.

                   

                   

                   

                  I hope this helps.

                   

                   

                   

                  Garland Smith

                  • 6. Re: PATROL- LOGErrorLvl

                    Thank you all for your help!

                     

                    Maybe you will be able to help me also with my second problem:

                     

                    https://communities.bmc.com/communities/message/273898#273898

                    • 7. Re: PATROL- LOGErrorLvl
                      Steve Robinson

                      I have the same question and the answers below do not seem to answer the question.

                       

                      Where is the "Alarm #2 of global parameter 'LOGErrorLvl' triggered on <Log Instance name>" event being generated?

                       

                      • 8. Re: PATROL- LOGErrorLvl
                        Garland Smith

                        Hello Steve,

                         

                        LOGErrorLvl is a parameter in PKM for Log Management (I think it’s in LOGMON.km).  This parameter is used to generate the Alarm or Warning when a string is found in a monitored log file matches the pattern that’s contained in the monitoring definition.  Let me know if you need more clarification.  Essentially, the way PKM for Log Management works is to look for a defined pattern and if it’s found, set LOGErrorLvl to Alarm or Warning based on the definition.

                         

                        I hope this helps.

                         

                        Garland Smith

                        • 9. Re: PATROL- LOGErrorLvl
                          Steve Robinson

                          Garland, Thanks for the input on the Log KM but that is not the issue here.

                          The issue is that I was seeing two events within BPPM.  I believe now that one the events I am seeing  'NOTIFY_EVENT'  is being generated by the Event management KM running on the patrol agent.   The second alert looks to be the actual event coming from the patrol agent?

                           

                          Steve

                          • 10. Re: PATROL- LOGErrorLvl
                            Garland Smith

                            Hello Steve,

                             

                            Let me try to explain:

                             

                            One of the things that exists inside each PATROL Event Classe is a “Notification Command”.  I’m pretty sure this mechanism has been in existence since the beginning of PATROL time, certainly since I started working with PATROL in 1996.  I believe the intent was to provide a mechanism to execute code to provide an actual notification (i.e. send an e-mail, page, etc…) or even execute code to address an issue (similar to a recovery action).  PKM for Event Management leverages this mechanism in order to deliver Notifications and perform PKM for Event Management Recovery actions.  A block of PSL code has been inserted into the “Notification Command” for each and every event class for which PKM for Event Management Notification Commands and Recovery Actions should be executed.  This is essentially the interface between PKM for Event Management and the PatrolAgent and it’s the basis for all of the good stuff the PKM for Event Management is able to accomplish.

                             

                            In your case, PKM for Log Management initiates a Standard Event 11 (parameter crosses a defined threshold) for LOGErrorLvl.  When this happens, the Standard Event 11 notification command is executed, which results in the NOTIFY_EVENT.  This happens because a PKM for Event Management rule in pconfig is configured to generate a Notification for LOGErrorLvl.

                             

                            If you take a look in StdEvents.ctg (I think you can do it with a text editor but it’s ugly, using a PATROL Classic Developer Console is easier to look at), you’ll see the PSL code that I mentioned above.

                             

                            To the best of my knowledge, there is nothing that documents this.  It’s just the way it works.

                             

                            I hope this helps.

                             

                            Garland Smith

                            • 11. Re: PATROL- LOGErrorLvl
                              Steve Robinson

                              Garland, Thanks again, and we are too old hands at this and I do have a lot of the same understanding of the product that  you do. You are trying and are going above and beyond here and thank you.  I understand PSL very well as I have one routine that is 12 pages.  We are on the same page, but you covered a number of bases that I did not. 

                              Steve

                              • 12. Re: PATROL- LOGErrorLvl
                                Garland Smith

                                I thought you asked where the NOTIFY_EVENT comes from.  I tried to answer that.  Maybe I misunderstood your question.

                                Garland Smith

                                • 13. Re: PATROL- LOGErrorLvl
                                  Garland Smith

                                  I’ll take another stab at this.  I believe the two events are:

                                   

                                  NOTIFY_EVENT comes from PKM for Event management

                                  PATROL Alert is the Standard Event 11 for LOGErrorLvl.  This event causes PKM for Event Management to generate the NOTIFY_EVENT.

                                   

                                  If that’s not what you’re asking, then I don’t have any idea what you’re looking for.

                                   

                                  Garland Smith

                                  • 14. Re: PATROL- LOGErrorLvl
                                    Steve Robinson

                                    We are on the same page Garland.

                                    Thank you.