Preventing excessive email notification from server.

[admin347]

I am using HP SIM 7.3. I have a lot of servers connected and from time to time one of servers is generating huge amount of traps - for example last time i get 78 messages (SNMP) Server Redundancy Lost: Important SIM events.
These messages are forwarded to first line support and they are very angry when they get 78 SMS messages :)
I waste a lot of time searching for solution to prevent repeatedly send the same notification in the same time - maybe you will be able to help me ?
Thanks in advance.

[BPE]

We use HP Insight Remote Support (IRSA in the past) together with SIM. In this configuration you can forward the service events to the service/help desk which reduces the number of events to the ones which need to be handled because a hardware service provider will call them to arrange the appointment for the repair or component shipment.

If your organization needs to handle all the events you need to check with the service/help desk software vendor for duplication detection or if the amount of events per day is not to high you can write an event automation task which checks first in if the trap did recently open an incident in your service desk tool. (Perl VBA or powershell can be used if the number of events are not to high)  

[admin347]

Is that mean that there is no mechanism on HP SIM level to stop sending duplicate emails and i need to stop it on the SMTP server level for example (using scripts) ?!

[BPE]

Yes SIM is displays all the SNMP Traps. IRS / IRSA has time filters and filter to check for events which are relevant for HP.

Is it correct that you use email to forward events to your service desk?  If this is the case you have a much better solution if you only use the mail forward from IRS to the service desk.

Simple rules are possible inside SIM event automation. 

There is also some build-in logic for reachable events to close previous nonreachable events.

But I would also ask for your service desk tool  vendor for a SIM integration.

I just remember that HP for example provided some integration.

I do not know the current state of this packages.

[BPE]

To clarify you can handle the event on the SIM Server in a script which sends only event if the this type of event from this secific server was not send in the past x hour. But it will be your one logic.

Perhaps it is simpler to use the log functionality and using something like logwatch an open source tool. There was also a tool which was writen by some HP people some years ago to apply rules to logfiles but I do not remeber the name. This would fit very well to your needs.

It will not take very log until first level people will define you a list which event should be resend after x,y,z minuites / hours or only if the event happend n,m times . Take care the you have a good concept from the begining. And think about the life cycle of the product (In your case HP SIM).

[admin347]

My environment is not homogeneous - i have different servers and equipment and i use HP SIM mainly to resolve traps and send events to first line. I need spam like filter to prevent sending 100 emails which come i the same minute from the same host with the same subject.