Automatic Event Handling no e-mails

[mrigendra]

HI Andrew,

what about the SNMP where we not getting alerts but can see issues when click on health status.

do you recommend any seeting which can resolve this issue.

[Andrew_Haak]

Hello,

I would open a new post and i can help you there. This was already discussed here so to keep things clear for each other let's start a new topic for you question oke ?

I will go into further detail when you opened a new post.

[Bob Zabaga]

Hi Andrew. I'll check that out. I use Powershell off & on for remote admin, so i'm familiar with it. Over the last day or so I configured the AMS/iLO SNMP on 3 servers. From the configuration screen in iLO, you can send a test trap. With all 3, as soon as I clicked the "test" button, HP SIM showed the alert. But I only ever received an e-mail for machine "a". the other 2 machine's alerts produced no e-mail. And the one email I got was immediate. That problem is still at the top of my list....I always get my alerts, but only a portion end up sending an e-mail. That defeats the purpose of most of SIM for me. IT management is just going to say, "what happens when hardware fails after hours or on the weekend and nobody gets alerted." I can manually log in to SIM and check hardware status during business hours but the e-mailing problem is preventing SIM from being a hardware monitoring solution. I'm going to install Wireshark on my HP SIM server to watch and see if SIM even *tries* to send out an e-mail - wireshark can show me attempted SMTP traffic over tcp port 25....this will let me know if SIM is not even trying to send an e-mail, or if it is but its getting blocked or lost during transmission. I suspect its not attempting to send. If you have any thoughts about the e-mail issue I'll definitely listen!

[Andrew_Haak]

If you only get an email for one server! Could you show the events for an other server that's  receiving traps that you don't get emails for. And just to be sure did you change the auto rule clear the event also?

With the clear option you can tell if the event triggered your auto job for clean and email. I have had muliple setups of SIM and almosg never had any problem forwarding events. As you say tha's the whole point of monitoring so keep me informed with your progress...

[Bob Zabaga]

Running Wireshark on the HP SIM server and monitoring for SMTP (tcp port 25) traffic helped me resolve this. My Wireshark showed successful communication between HP SIM and my Exchange SMTP mail server every time. From Wireshark, I could see my SMTP/mail server showed an "email queued" status for every alert. What was happening? Microsoft Outlook on my pc (and others who watch for these emails) was classifying these emails as "junk" and automatically putting the incoming alert emails into the "junk" folder in Outlook. Why would some come in to my inbox and others be classified as junk by Outlook? No idea. That makes no sense to me. The solution is to go to Outlook Safe Senders and add "hpsim@mycompany.com" to the safe senders list. The Junk/Safe Senders location varies depending on what version of Outlook you use. I think the e-mail problem has been resolved! So the bulk of HP SIM is doing what I need. I just have to figure out what servers need to use SNMP vs. WBEM vs. AMS/iLO then configure....which means adding or removing monitors from servers. Some older servers were never loaded with the HP WBEM component, but I can add that where needed. I probably have to figure out what to do with the servers where I'm monitoring with AMS/iLO - those machines all already are monitored in SIM using window's snmp service (and/or WBEM)....but as you said before, I can use AMS/iLO and disable those other monitoring methods. The only possible "gotcha" is that we have other software products that gather SNMP data from servers, so I may not be able to turn off the standard windows SNMP service on those servers. Maybe then I just tell SIM not to use the standard windows SNMP service if I'm doing AMS/iLO. -thanks for all the help Andrew Bob

[Andrew_Haak]

One tip,

Change the snmp community for the ams servers, use that community for the other tool and don't tell SIM this new community or better allow only the other tool access to the windows SNMP. Default community SIM uses is Public so if you don't use that SIM can't login. These settings can be replicated to the AMS servers using the replicate funtion in SIM. Also remove the server first from SIM and readd then again.

[Bob Zabaga]

Alright, thanks.

Hey, do you see any point in scheduling "Discovery" jobs to run on a regular basis?

I'd think once your servers have been discovered, there's no point it doing that repeatedly...well not in my case anyway.

I guess maybe if you're unaware of other people or departments putting up servers, this would find them if you discovered by an IP range.

Whoever initially configured our Discovery jobs just put all the host names in the list of servers to discover.

So I don't see why that would be ran on a regular weekly basis.

If I ever add a server or servers, I typically would make a new discovery task for it.

See my screenshot. I think I should take these off of a regular schedule.

...this has gotten a bunch off the original topic! If you think I should start a new post I can.

What are your thoughts on the discovery jobs?

-bob

[Andrew_Haak]

Hello again Bob,

i've also disabled the sheduled discovery. If you scan whole subnets you might irritate other colleges with the logging the scans cause. If you have blade servers, most servers will get added because the enclosure adds them. On DL servers you could run a scan every x times depending on the changes in the datacenter.

I did export the types of servers OS and put them in separate discovery job. Just as a disaster measurement.

An other advantage to having separate discovery jobs is that you can leave the general protocol settings to SNMP public & Public only. This setup prevents all credentials to be used on all objects.

The only disadvantage is that you need to add objects using the discovery jobs so per OS type.

[Bob Zabaga]

Hi Andrew.

On the G8 and G9 machines, where I've configured AMS on the iLO port, I still have standard monitors set up on those servers too. So the G8 and G9 also have standard SNMP & Ping in addition to the iLO AMS monitor. 

See screenshot. You were saying I should just use iLO/AMS and not use both.  

What's the best method to tell HP SIM not to do the plain SNMP and Ping anymore.  I don't want to make changes at the servers themselves, just in HP SIM.  Should I keep ping? I don't see PING as an option via iLO AMS. Maybe I should keep that.  I was looking for somewhere where I could select these G8/G9 servers one by one and tell SIM not to monitor with standard SNMP anymore, since I set up iLO/AMS. THANKS!

I can pick "Options -> Suspend Monitoring" on the server itself and just let the iLO alone. See 2nd screenshot. Is that a good way to just use iLO/AMS?

-Bob

[Andrew_Haak]

Hello Bob,

If you want SIM to stop using SN M P for it's gen8 or higher servers you can do two things:

Configure the SNMP on the Gen8 and higher server not to allow the SIM server access the SNMP. This can be done by setting one server to allow only localhost and not the SIM server exporting this registry and importing it on your gen8 and higher servers(if you have it run the registry patch from a deploytool or use powershell ). You can also create a gpo for a seperate OU where you put the gen8 or higher servers in and set the SNMP settings.

The other option would be to use seperate communities for gen8 and higher and other servers. The community for the gen8 and higher. If this is done don't set this community in the general settings so SIM won't pick it up and use the community for any other tool that you use SNMP for.

If possible i would recommend not to use public or Public for servers as they are used by devices like switches and you do need these. 

[Bob Zabaga]

Thanks again. With the G8/G9 where I'm using iLO/AMS monitoring, I'm going to go with the "suspend monitoring" option and see how that goes. -Bob

[Andrew_Haak]

Hello Bob,

i would not do that if i where you. At least check if you send a test SNMP allert from the ILO if the event is mapped to the disabled server. This should happen if you configured the ILO to send as the systemname instead of the iloname.

If things are not clear let me know because i would think disabled de ices are not monitored certainly if they are disabled.

Devices almost always use public or Public, if servers also use these communities you can expert problems if you want to monitor devices but don't want to monitor gen8 and above. Do you know how to configure SNMP in Windows? To ne specific the security setting ego mag read the SNMP remote? Normal is localhost and your SIM server, but not for grn8 and above.

When you have gen8 and above you need to create separate jobs for Windows and other servers. The general settings need to be as clean as can be. Perhaps you should only have the common public & Public SNMP community settings. If you don't servers will pick-up the general SNMP and/or WBEM settings.