SOLVED
I have a custom rule that escalates syslogs about excessive broadcasts and sends us emails about those alarms. Now, we get emails for each instance but in IMC, under the alarm section, it only shows the latest entry per device / switch. It'll update to the most recent one and it keeps count. Is there a way to make it show every instance of a syslog or just the most recent per switch.
Hello,
Please go to System > System Configuration > System Settings and try setting this to No:
Configure Repeated Alarm Count: If you enable repeated alarm count, the repeated alarms are aggregated into one alarm. You can view the number of alarm repetitions in the Repeat Count column of the alarm list. The system determines syslog alarms as repeated only when both their Parameter List values and key parameters are exactly the same. The system determines other types of alarms as repeated when their key parameters are the same.
That should turn off the "alarm counting" that you have described.
Justin
Working @ HPE
Hello,
There's no way that I'm aware of to tune it per-device or something similar. However, you can always fine-tune your alarm settings to prevent getting excessive amounts of alarms in the first place, unless there are serious issues in the network.
Some examples...
- Make sure the fault-finder on ProCurve/ArubaOS is tuned properly and not overly sensitive.
- Ensure that interface alarm filtering is configured correctly to ignore interfaces like access ports going down.
- Set up trap filtering, which can be done on per-trap and per-device basis, so that you don't receive unnecessary alarms.
- That includes a default Duplicate Trap Filter which can be tuned to filter/unfilter only specific traps.
- Filtering can be applied to Syslogs as well with the syslog Filtering Rules.
Hope that helps.
Justin
Working @ HPE