Insight Manager 7 SP2.1 - Old Notification Flood

[Dan Lynch]

In the last month we have been flooded (1000+)with notifications of old events twice and I can't figure out why. We have been using Insight Manager for several years now and this is the first time it has happened. I cannot see anything in the notification tasks that point to a direct cause for this. Has anyone experienced anything like this?

[James Kennedy_4]

I've had this probably after rebooting the server with IM on it. When it comes back online, it sees all the servers are down until it does a successfull polling loop a few seconds later.

Either a reboot, or your IM machine lost network connectivety with every other machine on the network for a little bit. Someone trip over the NIC cable? :)

[Dan Lynch]

I don't think it's due to the snmp polling loop...The messages we are receiving are old - up to a month old. They are duplicate messages and we get flooded with them by about 1000 at a time. In the notification task log, I don't see anything suspect.

[Tim McGue]

I had the same problem twice in the new HP SIM 4.0. I have a case open with HP. I'll post when we find anything. Right now we are looking at a system that was listed twice - one with an IP and one without an IP. We also looked at the initial data collection/daily device identification/initial hardware status polling.

Tim

[Jadrice Toussaint]

Dan -

I've posted answers to a similar issue. The first thing I would do is check your event queries. The one that the notification task is referencing. then I would check the notififcation task. If you can, attach a screenshot of your query and notification task inia word document so that I can take a look.

[Tim McGue]

Jadrice,

In the new SIM it doesn't look like there is a good summary screen to capture. This is what I have for my task that ran 630 times yesterday:

events: severity is critical
systems: system name is (any)
action: run a custom command
time filter: none

Tim

[Dan Lynch]

I just deleted those tasks and started fresh...I do have a backup of the database. If I restore it to a temporary db, does anyone know a query I can run to get the notification task info?
I believe the problematic task ran the
"Important Uncleared Events" on "When new devices or events meet the query criteria".
Thanks everyone for your help.

[Dan Lynch]

The notification task was for sure

Important Events (In the Public Queries/Events by Severity)
Set to run when "new devices or events meet query criteria"

Hope this helps...

[Flemming Skjoett]

Hey all, your not alone :-)

Once a while our CIM 7.2 SP2 descides to resend all alarms. If we spot it starting, we reboot the server asap, but when i happens during the night we will wakeup to a full mailbox the next morning... roughly ~56.000 emails will be there to be deleted.

As far as we can tell its all the email notifications CIM ever sent.

There is no pattern as to when the resend happens, it can be anytime of day, and it does not repeat at regular intervals.

If anyone have a clue why this is happening, we would really appreciate it!

Best regards
Flemming Skjøt

[Dan Lynch]

I'm glad to hear we are not alone. I have found it doesn't happen when I filter the event criterea by Cleared Status to only include Not Cleared events. Now sometimes it only repeats notifications that have not been cleared...
We're switching to HP Systems IM in the next week or two, so hopefully this possible but will not show up again...Thanks for letting us know we're not alone!