change the severity of an event in HP SIM 7.4

[blentes]

Hi,

i'm running HP SIM 7.4 on a SLES 11 SP3 64bit box. I'd like to change the severity of some events. I googled around and found some folks proposing to change it in Options ==> Events ==> SNMP Trap Settings. I changed the desired severity (from informational to major), the WBI accepted it, but in the event log it continues to appear as "informational". If i edit the description of this event, the change is visible in the event log. Any ideas ?

Thanks for any tip.

Bernd

[Andrew_Haak]

The severity is only changes for new traps received, i've changed some mibs like asr server is online from minor to major and that works but only for newly received events.

[blentes]

Hi Andrew,

it's logical that it is only for new events. But although i changed it the severity stays unchanged for newly received events in the event log.

Bernd

[Andrew_Haak]

Wich event did you change in wich mib?

[blentes]

 Hi,

I try to change in cpqfca.mib the event 16028.

Bernd

[LGentile]

Most of the events in that MIB are "status change" events.  I am not an SNMP/MIB expert, but these types of conditions are set up to detect changes in hardware status and cannot be controlled the way you want to.  In other words, there are "sub" status codes that come from specific conditions.  So, you may have some that are informational, warnings, or critical errors all from the same OID/event and you can't change how any of those "sub" states come into SIM or filter them specifically.

So, what I am saying is, no matter what you change your event settings to, it has no effect on any of the "status change" type of events.  This is a fairly annoying issue since most of the hard drive and system battery alerts are of this type. 

I had to implement a workaround so I would not miss drive array issues that came in as "minor" or "warnings".  For example, I wanted to know when a logical drive array went into a "warning" status because very often, that is a failed rebuild or a repeated rebuild event, where there is no physical failure (yet), but there is logical corruption or something showing a failure may occur.  Normally, I don't send anything under "major" or "critical" for auto-ticketing.  I had to create a separate collection specifically for the Proliant Storage category, then send anything from "minor" on up to make sure I received them all.

I opened a case with HP on this a while ago and was simply told, that without editing the MIB you can't do much about these.  Since each SIM update replaces the default MIBs, i decided to work around it the best I could.

[blentes]

Hi,

i changed the severity directly in the database, but the event stays "informational", also for newly arrived events. Also when i change the severity via "Options ==> Events ==> SNMP Trap Settings", i saw that the severity was changed in the database, but still for newly arrived events it stays "informational". This is frustrating. Change of the status of a controller is something i want to be informed via e-amil, but i cannot send e-mails for every informational event.

LGentile, could you please explain your workaround a bit more clear because currently i don't understand it. Thanks in advance.

Bernd

[blentes]

Hi,

i changed another value in the database: sev_vb in the table trapitems. Using this, i managed to change the severity to "minor" or "unknown", but neither to major nor to critical. I used all the values for sev_vb i found in the database (0,1,2,3,4,6,7,9,10,12). Using all these values, the severity was mostly "minor".

Any ideas ?

Bernd

[LGentile]

My workaround was basically to create another event collection based on attributes that only looked for the specific events, but would include warning and minor in addition to major and critical, so nothing would be missed.

So:

Normal event collection = Critical and Major events for: ProLiant Storage Events, etc.. etc.. etc..  - this collection is basically everything I want

Special event collection for "status change" events = Minor and Warning for: ProLiant Storage Events, ProLiant Power Events (Only) (and whatever else you may want).

There is an event handler (one for each) assigned to these collections to send me an email (and an OM message for our ticketing system) for any new event in either of these collections.  Now what happens is, if there is one of those strange "status change" events for a prefailure on a HDD, lets say for example, that shows up as a "minor" event, I will get it from the "Special" collection I created.

It's tough to explain.. i can try to get some screenshots and attach a file.