Hello,
I'd like to trigger a correlation>Automation when an alarm storm delay prevention is activated (by x alarms during x sec).
I can't find in the info/suggestion console tabs any input that I can use for that purpose.
Is there a way to trigger this correlation?
Cordially
Hi Alexis,
I made a quick test, and indeed, it seems that there is no information event raised when there is an alarm storm. However, the alarm raised when there is an alarm storm is linked to an element with the DMA name.
So far, the only way I could trigger the correlation rule is using this element name as alarm filter.
Since multiple alarms could be linked to this element (and not necessarily related to an alarm storm), you will need to implement additional filtering in the automation script. You can receive information from the alarm that triggered the correlation rule using this method: How do I parse Correlation Alarm Info data?
With this information you could implement the necessary filter to identify the alarm storm.
For your information, you can find the enum values for an alarm here:
Structure Offload Database
Hope it helps.
Hi Alexis,
These elements are available by default. However, keep in mind that they are hidden (not available in the surveyor). In order to reproduce the alarm storm, I tweaked the alarm storm setting so an alarm storm can be raised with a small number of alarms (similar to the actions executed in the video that you included in your comment). You could perform the same test to confirm the element name.
I did a test but the elements 'DMA agents' don't rise any alarm about the storm protection.
I trigger well on other system notices, about run-time error, synchro agent error, … but nothing about storm.
Is there something that must be configured server side to add the storm events?
Yes I triggered a storm prevention to test it but no alarm appeared about "storm".
Just events like described before that I could check with [info] in the correlation rule.
For example->
Based on alarms:
ALARM ID ELEMENT PARAMETER ALARM VALUE OWNER SEVERITY SOURCE STATE TIME TYPE USERSTATUS
6029/23251159 SBVCP-DMAC23 Backup status Backup job had errors. !! Backup-process failed, see logging for details. Unspecified error (-2147467259) System Notice DataMiner System Open 2025-05-10 04:17:20 New Alarm Not Assigned
6029/23175744 SBVCP-DMAC23 Backup status Backup job had errors. !! Backup-process failed, see logging for details. Unspecified error (-2147467259) System Notice DataMiner System Open 2025-05-06 04:22:15 New Alarm Not Assigned
Some news,
In fact we have two cases:
-if alarm storm prevention from alarm with same parameter => alarm grouping
In this case I have an alarm "Video Bitrate (Alarm storm)", but can't trigger a coorelation with this (why??)
-if alarm storm prevention from amount of alarms on a period => alarms delayed (it's the case I work on)
In this case I have no alarm to trigger the correlation
(find below a screenshot to show exactly what happens)
Hi Alexis,
The alarm storm protection feature in Cube is a pure client side feature. It takes the settings from the user settings, which allows to behave different from one user to another. So User1 can configure it to be active starting from 100 alarms, while User2 can activate the feature from 1000 alarms.
The alarms you see in your console aren't really alarms that come from the server. Those 'alarms' are actually fake and are being 'created' by Cube on the client based on the user settings like described ^^.
Because those alarms aren't real, correlation will not receive them and so you cannot use them to trigger any correlation.
The only thing you can do in correlation is mimic the same behavior in a rule by grouping your alarms by parameter (grouping section) and add a condition with a count (count(*) > 1000). But of course this is yet another configuration and might differ from what your users have configured.
Hope this explains it a bit and inspires you with a way forward.
I saw in this recap there should be an event 'client notification (alarm storm)', but I don't get it. The recap is from 2017 so…
https://community.dataminer.services/video/ruis-rapid-recap-alarm-storm-prevention/?hilite=storm