Receive 50+ email alerts most are months old

[Danielle Mrdeza]

When our CSM looses and restores connection to an agent, we receive 50+ email alerts. When reading the email alerts, most of them are months old. I have checked the Integrated management log on the CSM and on the agent and there are no uncleared items. How can I configure it to only send the recent alerts? CSM is Win2000 SP4. Agents are Win2000 SP4 with a couple of Win2003 servers.
Thanks!

[Guido Koetter]

I had the same problem umless I changed the Mail-event as follows:

If the system is unreachable and assignee is not "server unavailable" as the beginning purpose follows by the actions with email to .... and assign event to "server unavailable"

The event works sequentially so only non-assigned events are mailed.

You need a runonce-job assigning all exisiting events with the assignee to avoid "spam".

[Danielle Mrdeza]

Thanks for the help. Can you tell me where to change this?

[Guido Koetter]

Under Options --> Events -->Automatic Event Handling --> Manage Tasks mark the event responsible for email alerts and change it as follows:

In step 4 activate assign to and enter a new assign like server unreachable. Save the event and reopen it. In step 2 add a new event assignee is server unreachable. You can choose your new assign via dropdown. Save the event.

This works for future events. To avoid the old ones choose the list all events and sort them by events. Mark all unreachable events and assign your new assignee. Depending on the number of events you can create also a list with search criteria server is unreachable.

That is the workaround. If anyone has a better one please post it.

Greetings
Guido

[Mike Kanakos_1]

I am not sure if this is the same issue.. I have an ongoing issue with HP about HP SIM 4.0 & 4.1. In a nutshell, we were getting "broadcast storms" of messages.

Some action would trigger a problem (like a change to one of the Auto Event handlers properties or disabling an alert group). Server events would also trigger the alerts as well. In the middle of the night, the server would go nuts. Somehow SIM would get caught in a loop and start sending out old alerts.

To clarify, admin would change a SIM setting or an event would happen (like server unreachable) and the software would get caught in loop and send out barrage of alerts. Alert dates went back as far as two months. We would get anywhere from 150 - 1000 alerts that forwarded to about 15 different two way pagers the admin staff uses. Do the quick math and you'll realize how annoying, frustrating & expensive it was. Only fix was to shut down SIM service.

HP has spent a great deal of time with me and has written a patch for my system. The patch has been in place for a week and so far no problems. I would guess that this patch would be included in SIM 4.2 or 4.3. But I was not told that by anyone at HP.

Hope that helps..

[Guido Koetter]

Hello Mike,

I had this problem with the old CIM using MSDE instead of sql. Reaching the 2 GB limit the system crashed by sending about 20.000 mails.


In SIM it is not possible to create an event similar to system is unreachable AND this event is uncleard. (auto-cleared when system is reachable) A similar event was possible in CIM but not migrated.

Greetings

Guido

[Alan Doran]

Hello,

I've got the same problem.....4,000+ e-mails every morning. Does anyone have this patch? Is it available anywhere?

Thanks
Alan.

[Jan Gunnar Heistad]

Hi Guys.

Take a look at the following web-site:
http://h18007.www1.hp.com/support/files/server/us/download/21987.html

I haven't tested it selves yet, but I assume that will work fine. It's worth to try.

[Stefan Holzhausen]

Alan,
A softpaq HPSIM Email/pager Message Storm Update SP26214.exe has been published at

http://h18007.www1.hp.com/support/files/server/us/download/21987.html

Hope this helps?
Regards,
Stefan

[Alan Doran]

Hello all,

Recieved the patch from HP last week. It's a bug in HP SIM 4.1 & will be included in V4.2:

"If an HP Systems Insight Manager (HP SIM) Automatic Event Handling task is configured to Send e-mail or Send page as the action on event and the task is subsequently Disabled and then Enabled, all the previous (old) events are resent. This could potentially amount to hundreds of e-mails and/or pager messages being sent to the designated recipients (an e-mail / pager message "storm").
Note: This may also occur (intermittently) when an Automatic Event Handling Task is edited. "

Installed patch on friday & am in the process of testing. So far, so good. No mail storm yet. I will continue testing over the next few days & update with results.

Rgds
Al.