Hi Guys,
We were trying to figure out if we can create an alarm based on two parameter state, which are on two different elements. These parameters are not in the alarm template since we dont want to alarm on them individually but rather alarm on them when both meet a certain condition.
We thought that we might be able to manage that through correlations but it seems correlations only work when there is an alarm in the alarm console. Is there a way we can look at two parameters on two different elements and generate an alarm based on the states of the parameters?
Hey Moazzam,
Whilst not straightforward, it is possible to do this with Correlation rule on information events. First of all we need to filter out the correct events in our Correlation rule. This can be done as following
This filter will ensure the correlation rule is only evaluated when an information event containing "Set *" is happening on param1 of Element "Firts" OR an information event containing "Set *" is happening on param1 of Element "second" (basically when a set happens on the params we are interested in.
By using script conditions in the rule filter we can then evaluate if both paramters have the required value.
This condition will check if param1 on element 408/126 (firts) and check is >=10 and if param1 on element 408/127 (second) is greater or equal to 20.
You can then use the "new alarm" action to create an alarm on the desired element.
P.s. by using alarm templates to generate information messages when a parameter exceeds/drops below a certain threshold you can refine the filter even more to only evaluate the rule on events you know you are interested in by filtering the information events on those values.
Kind regards,
Hi Moazzam,
You could indeed also achieve this with an enhanced service (not a regular service). An enhanced service has a service definition, based on a protocol xml. In this service definition, you can copy the needed parameters from the two elements into the enhanced service. Then in the enhanced service you can either define an alarm template with conditional monitoring, e.g. only activate monitoring on the first parameter if the second parameter meets a certain condition. Or you can add logic in the service definition to combine those two parameters into a new parameter which you use then for alarming.
Another solution would be to tackle this in the protocol xml. Either by modifying one of the two protocols to be able to copy the parameter from the other element, or to create a new protocol which copies both parameters of both elements into a new element. This can be done with element connections. Then you again have both parameters in one element and then you can use conditional monitoring again or add the logic in the protocol.
Thanks Brent for the detailed reply. We have used your suggestions and have come up with a solution. We were wondering if there is any other way we could achieve this like using Services?
One more thing, is there a way to use Normal severity instead of informationals to achieve the same results?