Configure an alarm notification when a switch comes back online after it went down

[justin-harper]

I have alarms set for whenever any of my switches or major network devices goes down. I need to know how to configure IMC for when those same devices come back online after being down. Basically, I receive an email alert when a switch goes down but not when it comes back online as most of the time they come back online on their own. It would just be nice to be notified when it comes back up. The pic attached is my current alarm config for when they go down.

[NeilR]

There are critical alarms for "doesn't respond" when down and "cold start" when back up - you could use those.

Or point your syslog from the devices to the imc server, then browse the syslog (under alarm) for a message that you want to use - the procurves have a message "System Booted". Use Syslog to Alarm to match that message and then those syslog entries can generate an alarm that you can use for messaging etc.

[justin-harper]

Where would I find the critical alarms for "doesn't respond" and "cold start" inside the console? I attached another screenshot to help. You will have to forgive me, I am sort of new to IMC. If you view my screenshot, the Switch Critical Alarm is the one that works, and the Switch Recovery does not. In Switch Recovery I had Device Service UP selected and added Link State UP, but cannot find "cold start" as you mentioned in your response. Any help is appreciated and thank you for your patience.

[LindsayHill]

I wrote this ages ago. Screenshots might differ, but should be close enough to find the new version.

http://packetpushers.net/hp-imc-email-alerting/

[justin-harper]

Your article was what I followed first and it was definitely very informative. In the updated IMC though there is no longer " In this case, go down to “NMS Resource” and choose “Device Accessible."

Now, under NMS Resource, the closest thing is "Device SNMP Accessible" which I have selected, just waiting for a time I can test it to ensure it's the same thing. If those two are the indeed the exact same then I feel like an idiot. As I mentioned earlier I'm new to this software.

Also, one other addition to the new version is "Enable stage forward" which I have disabled. That doesn't appear in your screenshot from your article. Not sure what to do with that one either. I uploaded another screenshot to show you if you dont mind taking a look.

[LindsayHill]

Don't know what "Enable stage forward" is about. You'd need to look in the docs or online help.

Couple of things:

- You have only selected Critical alarms. That won't match if you also want to match on "Device Up" alarms - those will come through as Info. So your current email setup won't trigger 'recovery' alarms.

- Device SNMP Accessible sounds plausible. The best way to check is to look through your alarm history for when a device came back online. Check to see what things were logged.

[justin-harper]

See that is the frustrating thing about this software, I can't find any of the data you are saying would help me. I pull my real time alarm reports and everything just shows me when the device goes DOWN, never UP. Can't find a single link, radio button, or drop down that will show me an inkling of a piece of data stating when any of these devices have gone back UP. I attached another screenshot to show you what I'm talking about. The screenshot is an alarm report for one of my switches, which I left out of view for obvious security reasons.

As for only having critical alarms selected, that's what my existing alarm was setup with. That one was already in place before I was hired. There is nothing fancy at all about it. Check that screenshot out. It's as bare bones as you can get yet it notifies me everytime a device goes down. I can actually only upload one picture at a time. I'll reply right after this one and upload that alarm config.

[justin-harper]

Switch critical alarm config pic attached.

[LindsayHill]

That config to send emails for critical alarms is fine. That doesn't need to be changed. It's the **NEW** rule that you need to set up to send the 'recovery' alarms that needs to include INFO level. That's what I put in that earlier blog post.

Rather than browsing "Real time alarms", which only shows the last 50 unrecovered alarms, look at All Alarms, which should show you the recovered alarms.

[NeilR]

Just to check - you did enable your switches to send traps to imc? 

Not responding is an IMC alarm (i think enabled by default, but could not recall where the setting is) as IMC constantly polls

 But cold start is a trap sent from the device, so no traps, no alarm. Also shows a syslog created alarm I created