Server Management - Systems Insight Manager
1748177 Members
4277 Online
108758 Solutions
New Discussion юеВ

Re: Event Collection?

 
Alan Barber
Advisor

Event Collection?

In setting up Automatic event Handling is there a way to add or change the selections in the Attribute-driven event collection? I just want to get the "Systems by Status" events but do not see a way to do this. Anyone know how to do this? Thanks!
9 REPLIES 9
Tom McGuigan
Frequent Advisor

Re: Event Collection?

I have the exact same question. We need to discover and monitor many more servers than we need to watch alerts. Thus, we need a way to create an events collection that is limited to a specific group of servers. I see no way to do this?? ANYBODY?
Wijnand Lammens
Advisor

Re: Event Collection?

In "Systems and Events", select "Customize" to create a new Collection with the desired selections.
Note the small "show" dropdown to select either systems or events on the Customize Collections page. For automated event handling you need to create an events collection, but "systems" is the default value in the dropdown.
Then create a new task in Automatic Event Handling, "with an existing event collection", using the desired event collection.
Tom McGuigan
Frequent Advisor

Re: Event Collection?

I appreciate the response, but unless I am missing something, my question remains unaswered.

Imagine you need to discover 100 systems. SIM automatically will gather alerts and events on all 100. However, you really only want to monitor alerts on 50 of the 100.

How can you simultaneously discover all 100 and yet present a collection of events consisting of only the subset of 50?

From what I see so far, all collections consist of ONLY events OR systems, but NOT BOTH as means to filter. Thus, it is impossible to create 1 collection that shows all events for a given group/subset of systems. Am I mistaken?
EricP
Frequent Advisor

Re: Event Collection?

This is certainly possible. We have roughly 300 servers. Of those, roughly 50 are email/exchange related servers.

I set up a separate list of "Mail servers". I designate "mail servers" by using the word "mail" in the contact field of the agents. This list simply looks for all servers with the word "mail" in that field.

I then set up an events list to capture events that occur on all "mail servers" - this is called "Mail Server Events".

So I have a list of all servers and all events related to them. In addition I have a list of just "mail" servers (a subset of the all servers list) and then a list of all events related to just the mail servers.

You need to create two things:

1. a list of the SYSTEMS you want a subset of (where some attribute distinguishes them, like names, IP range, etc).

2. a list of EVENTS that points to (refers to) that list of systems you just created.

Isnt' this what you are trying to do?
Tom McGuigan
Frequent Advisor

Re: Event Collection?

Your solution relies on finding a common attribute or having the freedom to modify an attribute of each target server to be monitored. However, in my case there is no common attribute, nor am I free to modify attributes such as contact (due to regulated environment rules). Thus, I cannot use your approach - clever as it is - as much as I would like to.

However, IF I could create/use-existing collection of systems AND combine it with a collection of events, then I'd have the desired results. Unfortunately, this appears to be beyond SIM.
EricP
Frequent Advisor

Re: Event Collection?

Well if there is no common attribute among the 50 servers (out of the 100), why do you want to manage/list events on them separately? There must be some common feature to them.

Also, (although more cumbersome) you could set up a list of the servers by host names (all 50 of them) -- or IP address -- and then setup events related only to that list of host names (or ip addresses).
Tom McGuigan
Frequent Advisor

Re: Event Collection?

Eric,
The servers which we alert on are individually identified by application owners as "important". There is no other criteria that exists to identify them. We already have a collection which identifies each "important" server. The problem is I don't know how to "setup events related only to that list of host names". Can you elaborate?
Tom McGuigan
Frequent Advisor

Re: Event Collection?

Eric,
The servers which we alert on are individually identified by application owners as "important". There is no other criteria that exists to identify them. We already have a collection which lists each "important" server. The problem is I don't know how to "setup events related only to that list of host names". Can you elaborate?
EricP
Frequent Advisor

Re: Event Collection?

1. choose customize (under systems and events)

2. choose events (next to "show")

3. click "new"

4. under "new collection" choose "where system name is"

then just put in the host names of all 50 servers.

5. AND also put in "where severity is "any" (or if you want to limit the events in the collection to certain events, pick and choose from the event types).

Now this would be easier to manage in the future if you could first just put the word "important" in the contact field (or role field) on each of the agents (this doesn't harm or change anything -- so your change control should allow this to be done).

Then instead of making an event collection by 50 host names, it could be done by the role or contact field identifier.