HPE Community read-only access December 15, 2018
This is a maintenance upgrade. You will be able to read articles and posts, but not post or reply.
Dec 15, 4:00 am to 10:00 am UTC
Dec 14, 10:00 pm CST to Dec 15, 4:00 am CST
Dec 14, 8:00 pm PST to Dec 15, 2:00 am PST
Server Management - Systems Insight Manager
Showing results for 
Search instead for 
Did you mean: 

Events generated with mismatched severities

Trusted Contributor

Events generated with mismatched severities

I've noticed some strange behavior with severity levels on some events.


I received a specific event for a pre-failure on a hard disk drive that came in as 'Minor' when the SNMP event itself was set to be 'Major'.  I checked the setting and exact message in the SNMP Event Settings area to verify.  I hadn't made any changes to this event.  


Any else seen this?



Trusted Contributor

Re: Events generated with mismatched severities

OK i just figured out why this is occurring and it is specific to the "Status Change" events.  Basically, as everyone probably knows, there are different values for these events depending on the actual issue. Those values have different severities (apparently) but I do not know where they are coming from.


Below is a snip from the MIB and the exact event in question:


cpqDa7PhyDrvStatusChange TRAP-TYPE
VARIABLES { sysName, cpqHoTrapFlags, cpqDaCntlrHwLocation,
cpqDaPhyDrvCntlrIndex, cpqDaPhyDrvIndex,
cpqDaPhyDrvLocationString, cpqDaPhyDrvType,
cpqDaPhyDrvModel, cpqDaPhyDrvFWRev, cpqDaPhyDrvSerialNum,
cpqDaPhyDrvFailureCode, cpqDaPhyDrvStatus,
cpqDaPhyDrvBusNumber }
"Physical Drive Status Change.

This trap signifies that the agent has detected a change in the
status of a drive array physical drive. The variable
cpaDaPhyDrvStatus indicates the current physical drive status.

User Action: If the physical drive status is failed(3),
predictiveFailure(4), ssdWearOut(8) or notAuthenticated(9)
replace the drive."

--#TYPE "Physical Drive Status Change (3046)"
--#SUMMARY "Physical drive status is now %d for drive at location %s connected to controller in %s."
--#ARGUMENTS {11, 5, 2}

::= 3046


So, where does SIM get its "other" severity levels from for things like PFAs (which come in as Minor) vs. a failure (which comes in as Critical)?


Basically, this is why this is important - we have events coming to HP OM that are Major and Critical only - there simply is too many minor/warning messages captured in SIM to send them all.  So I have been adjusting MInor events to be Major where possible so we can ensure we get the events.  In this case, the "main" SNMP Event Setting is not enough, so we are missing PFA events right now...