Event Monitor Notifications - send to a different address

[gunners]

Hi Guys ,

Just a quick one , we have an old HP-UX 11.11 system which sends Event Monitor Notifictations (like hardware issues etc) to a certain mail address.

I want to add in another mail address.

Where abouts is this done? I presume there is a file somewhere that you need to add in the addresses ? and if so do you have to restart smtp or anything like that when its done ?

Cheers Guys

[rariasn]

Hi:

monconfig - is a utility that allows a superuser to manage hardware  event monitor requests for EMS.

/etc/opt/resmon/lbin/monconfig

-->  (M)odify an existing monitoring request

man monconfig

rgs

[gunners]

Hi there rarisan,

Thanks for the pointer - Im having a look at this , just wondering can you add in multiple email addresses ? - for example alerts go to one mail (but if he is on leave or out) no one sees the issues. We just want to add in a few so we have more visibility of issues.

Cheers,

[Dennis Handly]

>just wondering can you add in multiple email addresses?

It may be easier to send to a mailing list that you can maintain externally,

[donna hofmeister]

aside from maintaining the list externally, i believe you can only enter a single email address.  so if you want to send EMS messages to a group, you do indeed need to set-up a distribution group and use the group's email list within monconfig.

so here's a bonus question (sorry for co-opting the original question) -- anyone know where to find anything that documents remote monitoring within EMS?  i'm at a loss...

[Torsten.]

HP's solution for systems with support contract is called "Insight remote support standard/advanced", read more:

http://h20000.www2.hp.com/bizsupport/TechSupport/DocumentIndex.jsp?lang=en&cc=us&taskId=101&prodClassId=10008&contentType=SupportManual&docIndexId=64255&prodTypeId=18964&prodSeriesId=3927988

[donna hofmeister]

a pox on me for not being specific at all...

box #1 will send EMS alerts to box #2 -- which is confusing my customer because they think box #2 is having problems.  these are both older (11.0) systems, so there's nothing as glorious as SMH, etc.

is this alterting being done via email?  that's the only thing i've been able to come up...

[Bill Hassell]

Here's the easiest solution:

Run monconfig (cleverly hidden in an obscure, non-standard location: /etc/opt/resmon/lbin/monconfig) and change the email address to ems-notify.

Then edit /etc/mail/aliases and add an alias: ems-notify : joe@abcd.com, jen@wxyz.com, me@etc.com

Be sure to run newaliases after editing the aliases file. Now you can change the EMS address at any time by editing the aliases file - no need to run monconfig. Works fine on 10.20 and up.

[gunners]

Hi Bill , that sounds like a great solution.

Was having a look around monconfig - I cant see the part where I have to change the email address bit though :s

[Bill Hassell]

Run monconfig and tyep the s command to show what is currently monitored.

You should see something like this:

...
      with severity >= MAJOR WARNING to SYSLOG
   2) Send events generated by all monitors
      with severity >= INFORMATION to TEXTLOG /var/opt/resmon/log/event.log
   3) Send events generated by all monitors
      with severity >= MAJOR WARNING to EMAIL root

 Item 3) is typical for email monitoring and the destination is root (not a good choice, especially for multiple systems and sysadmins). So type the m command to Modify. The m command will show all the monitor setups first, then ask for the monitoring request number. The above entry 3) is ready to use except the email address needs to be changed. Type 3, then <enter> to choose the current setting:

   Enter monitor numbers separated by commas
      {or (A)ll monitors, (Q)uit, (H)elp} [a]

Criteria Thresholds:
   1) INFORMATION    2) MINOR WARNING    3) MAJOR WARNING
   4) SERIOUS        5) CRITICAL
   Enter selection {or (Q)uit,(H)elp} [3]

Criteria Operator:
   1) <      2) <=      3) >      4) >=      5) =      6) !=
   Enter selection {or (Q)uit,(H)elp} [4]

Notification Method:
   1) UDP        2) TCP        3) SNMP       4) TEXTLOG
   5) SYSLOG     6) EMAIL      7) CONSOLE
   Enter selection {or (Q)uit,(H)elp} [6]

   Enter email address: [root] ems-notify

User Comment:
   (C)lear   (A)dd
   Enter selection {or (Q)uit,(H)elp} [c]

Client Configuration File:
   (C)lear
   Use Clear to use the default file.
   Enter selection {or (Q)uit,(H)elp} [c]

New entry:
      Send events generated by all monitors
      with severity >= MAJOR WARNING to EMAIL ems-notify


   Are you sure you want to keep these changes?
      {(Y)es,(N)o,(H)elp} [n] y

  Changes will take effect when the diagmond(1M) daemon discovers that
  monitoring requests have been modified.  Use the 'c' command to wait for
  changes to take effect.

=================

Exit monconfig and edit /etc/mail/aliases to add ems-notify and the list of email addresses. Then run newaliases to activate the change.

The settings can be tested using:
     /etc/opt/resmon/lbin/send_test_event -v sysstat_em

You have to temporarily change the criteria level from MAJOR WARNING to INFORMATIONAL.

The systat_em is one of several events you can specifiy. Pick an event that is being monitored on your system. Once tested, be sure to run monconfig to set the alert level back to MAJOR WARNING.

[gunners]

Hmm, ok Bill thanks again for great info.

I've done all of the above , added in addresses and alias in the aliases file , ran newaliases which ran fine , checked that mail is up and running , changed the alert level to 'Informational' , ran several tests , but nothing has come though at all.

Is there anything else I could check ? :/

Cheers

D

[Bill Hassell]

Yes, check your mail log at /var/adm/syslog/mail.log. If you have never setup outgoing email on this server, nothing will be sent out. The vast majority of data centers will block outgoing email from any machine that is not part of a centralized system like Exchange.  To verify that EMS is working, change the ems-notify to point to root and test again. You should see the email in root's mailbox. Once that is working, you'll have to get the email server admin to permit email from your server to deliver to your business email. That's usually an easy task. However, if you need notifications to go outside the company (say,  for text messaging, etc), then the mail server must be configured to relay email for your server. Note that only outgoing relay is needed. You don't need to receive any email on this server in response to EMS alerts.

[gunners]

Hi again Bill,

Ok , yes I did have a look at that ok. We do have exchange etc configured and receive mails (so do the Apps Teams) , Data Protector backup mails etc so all of that is deffo configured

I had a tail -100 of the mail log as you suggested.

The last entries in it are of me running the 'newalias' command , but nothing after that (even though I tried  running a test after all of the above)?

This is a real Monday Challenge haha

:/

D

[Bill Hassell]

Since outgoing email works OK and there is no log for EMS messages going out, check that you can send a test message and it gets logged in mail.log:

mailx -s "test msg" ems-notify < /etc/motd

You can use mtail to quickly look at the bottom of the mail log.

If that is OK, then check the EMS logs in /etc/opt/resmon/log, specifically tail -50 for the api.log and registrar.log.