topic Re: Disable specific alerts in HPE OneView

Disable specific alerts

ovuser1 — Mon, 31 Aug 2020 17:15:23 GMT

Is it possible to disable a specific alert for a blade chassis?

For examle. We'd like to temporarily disable this alet Critical The stacking health has changed to disconnected. bladechassisA interconnect group for a specific chassis. is this possible to achieve?

Re: Disable specific alerts

ChrisLynch — Tue, 01 Sep 2020 17:09:54 GMT

Are you asking if an administrator can disable an alert within the UI? Today that is not possible. If you are using the EMail alerting feature, then you can look at the alert details, and use the alertTypeID property to exclude the value in your email filter rule. Here is an example on an email rule that will capture critical and warning alerts, but not when the alert type is a specific value:

status:critical status:warning NOT alertTypeID:REPLACEME

Re: Disable specific alerts

astacy — Thu, 15 Oct 2020 18:54:48 GMT

I want to suppress the new "Overall Security Status" alerts. Is there away to do that? For context the alert says, "Overall security status of the system is at risk" The resolution is, "Navigate to the 'Security Dashboard' tab under the 'Information' section on the iLO Web UI in order to evaluate your configuration for potential risks and view advice on improving system security. "

Re: Disable specific alerts

ChrisLynch — Fri, 16 Oct 2020 16:29:28 GMT

Unfortunately, we do not have the ability to suppress alerts within the appliance. If you are asking about email alerting, then you can add an exclusion rule by looking at the alert details for the trap ID and add a NOT alertId:{IDVALUE}.

Re: Disable specific alerts

astacy — Fri, 16 Oct 2020 16:46:20 GMT

Yes I am looking for a way to filter the email alerting. I have tried adding an exclusion rule but it's not working. The alert we receive says, "Overall security status of the system is at risk." The alert ID for this is 9030 so the exclucsion would look like this: status:warning NOT alertId:9030. Is that correct? And if I wanted to a a second one for 9029 would it look like this: status:warning NOT alertId:9030 NOT alertId:9029

Re: Disable specific alerts

ChrisLynch — Fri, 16 Oct 2020 17:00:13 GMT

Do you have a full screenshot of the event details? There should be an snmpTrapID table property name. You want it plus the value of that property to add to your filter.

Re: Disable specific alerts

astacy — Fri, 16 Oct 2020 18:29:03 GMT

Chris this is from the iLO event log:

The overall security state of the system is at "Risk".

Initial Update 10/16/2020 01:53:53

Event Class 0x23

Event Code 0x491

Recommended Action Refer to iLO user manual or Security Dashboard help page.

Re: Disable specific alerts

astacy — Mon, 19 Oct 2020 19:51:50 GMT

Re: Disable specific alerts

ChrisLynch — Mon, 19 Oct 2020 20:22:32 GMT

You want to use NOT alertTypeID:Trap.cpqSm2OVeralSecStatusChange as part of the filter. That should exclude the alert from propogating via email to the recipients.

Re: Disable specific alerts

astacy — Mon, 19 Oct 2020 20:33:45 GMT

Still receiving the messages. This is what my filter looks like.:

Re: Disable specific alerts

ChrisLynch — Mon, 19 Oct 2020 20:37:30 GMT

A few things:

Make sure I didn't fat finger the alertTypeID value.
Make sure the alert severity is Warning, and not Informational.
Do you have any other email alert filters configured on the appliance? Just because you are trying to filter it out for one email destination doesn't mean it is applied to all.

Re: Disable specific alerts

astacy — Tue, 20 Oct 2020 14:09:12 GMT

#3! I believe it was hitting a filter before that and never processing this new one. Problem resolved. Thank you!!!