Automatic Event Handling no e-mails

[Bob Zabaga]

I can't figure out why I don't get e-mail alerts with systems that major or critical events (or even minor). I have a few servers with problems, and the hardware problems (and severity) are displayed correctly in SIM. But I never get e-mails about it. If I go to "Options -> Events -> Automatic Event Handling" I can manage my automated task, check my e-mail settings and successfully send myself an e-mail. So it appears that both pieces work: my server's status is reported to SIM correctly and test e-mail works. But I never get e-mails when a problem occurs. Can't figure it out. The default "hardware polling" on all servers is 5 minutes...and as I said SIM has no problem obtaining the status of my servers. Any suggestions would be welcome! thanks BZ

[Andrew_Haak]

Hello,

What you probably forgot it to configure your servers to send snmp or wbem events in case of an error like a broken disk ect.

What you see is that the polling of the servers you see that something is broken but that is not the way SIM works. You only get emails when a trap of an error is received. What type of servers do you have and do you use SNMP or WBEM? You can run a repair when you selected your servers and set a wbem subscription or configure the SNMP settings? If you need more pointers let me know.

[Bob Zabaga]

Thanks for replying. I inherited this configuration recently, I didn't originally set it up. But it looks set-up completely to me. Some servers are monitored over SNMP and some WBEM (some both too). The server I'm using as an example has a memory issue and a bad hard drive. WBEM monitoring shows that, but I don't get an e-mail. Now I just pulled a 2nd redundant power cable on a spare server and I got that alert....hmmm...that server is only monitored over SNMP. I think I'd prefer WBEM, there's more detailed information. Anyway, I don't undestand why I wouldn't get the e-mail if the HP SIM server can tell I have a memory & disk problem. The servers are anywhere from Proliant G5s to Proliant G9s. I can see in a case where WBEM doesn't obtain ANY server information at all, it could be the age of the HP software/agent on it. But I'm confused since WBEM finds my bad memory & drive but never sends an alert. What can I check to resolve that?

[Andrew_Haak]

Hello, If you restart your agent the event should be resend if a subscription is set. If you are not sure select your server, go to the menu Configure > Manage Communications and wait. Next you will get a screen that tells you if SIM can identify the server and if it can receive events from it. If you have a lot of servers the use WBEM you should create an automatic job that will create these subscriptions once a week. Go to Menu menu option Options > Events > Subscribe to WBEM Events, select all servers as a destination. Select Next and then Schedule, set this to Periodically to run one a week on any day. This way any newly added servers get a subscription within a week.

[Bob Zabaga]

Hi. Those areas you listed check out fine - that's not where my problem lies. I can successfuly collect server information via SNMP and/or WBEM. I don't get e-mails when alerts occur. That's what I can't figure out. -Bob

[Andrew_Haak]

I know what you mean,

Polling SNMP or WBEM os a whole other thing (pull) than pushing event using SNMP or WBEM. The push events (traps) generate events in SIM. Do you see events under your server(s) or under all events? 

If the status changes it changes because off polling, events occur when traps are received. You can test this when you send a test trap from one of your servers. You should get an event if the traps are configured correctly.

If you see events see if you use the right event collection for the email forwarding.

[Bob Zabaga]

Thanks for your input. I appreciate it. I'll include an attachment (screenshot).

Under the System Status, I show "health status" for "All systems". I do see correct output here.

It shows 2 with a critical error, 4 major, 4 minor. But only a few of these events have triggered an e-mail alert.

for example, in my screenshot, I got an e-mail when one server had an issue but not the other - same severity too.

As a side note, on an older machine i'm using to test with, I pulled a drive in the array to see the resulting message and it falls under a "minor" event....wow, how is that minor?!?  But that's a separate problem altogether. Our e-mails (I think) just send out for critical or major...so a bad/missing drive being 'minor' is really irritating.

I'm not soo sure how cleared/uncleared/deleted events effect the e-mailing either. i.e. if I clear or delete a warning, and the problem still exists, will I get further warnings and e-mails too? I figure if the problem still exists, I'll keep getting trap messages.  I believe I understand what you're saying about the SNMP traps....in that each server has to send them to my SIM server, as opposed to SIM polling the machine to discover a fault - is that right?  All of that does seem configured correctly here. SNMP settings on each monitored server look good. 

Because the servers are of varying age, they may or may not have completely updated HP management software/drivers/wbem on them.  So it may be better to stick with SNMP. I know all have SNMP configured/working.

Well anyway, to some degree I have to learn more about SIM - - - I'm plodding through the super long PDF documentation.  Since this was all set up by a predecessor, it's a little cumbersome to go through. I'd call HP tech support, but I don't thnk they'd help me, based on my past experience of using their servers & 'support' for 10+ years.

I'll have to check YouTube to see if anybody has posted good tidbits for configuing/troubleshooting.

Thanks again for your posts.

Bob

[Andrew_Haak]

Let's start from the start.

Do you see the customize from the left top, click on it and then select the events also. Now you see the hardware ststus and the received events. Also look at the ES  green status on the server. This is the event status for your server. These change if there is an uncleared event. Please add a screenshot of the Events for both servers. If i create a rule that email i also select the option clear event. For test purposes you can use the all events collection to be used for forwardinh. You should  get a lot of emails.the collection you choose dictates the events you get emailed. I made an own collection that i want events from. These csn be created by hand.

[Bob Zabaga]

Okay. See screenshot.

Both of those systems show the "Health Status" on the main SYSTEM tab with an error.  My screenshot shows the one server had a network card problem. I included the EVENTS tab too on the same screenshot - but there it shown no error. So that's confusing me.  Why is there conflicting information? I think that error is just because that server has multiple NICs and only 2 are connected. * I think * 

Same situation with server #2 - so I didn't take a screenshot:  SYSTEM tab shows error, EVENTS tab is clean.  It had the 2nd redundant power supply cord pulled accidentally. It shows an error on the main SYSTEM tab under Health status but if i pick the Events tab, it is also empty.  I got an e-mail when that power cord was pulled and the alert triggered. Tee power cord was put back in shortly after - I *guess* you don't get an e-mail when a problem is resolved?? That would be nice but I'm not sure that's a feature.

Thanks for your thoughts. I really appreciate it!!!

Bob

[Andrew_Haak]

I'll get back to you tomorrow, local time here is 22:40 so talk to you tomorrow!