Hi All.
I wanted to create a filter using severity duration; however, this isn't available as a filter.
I looked at other solutions from previous questions, ranging from creating a GQI to correlation rules.
I thought about using a correlation rule using an alarm filter we use on Unacknowledged alarms and then applying a Rule based on the "Property.Alarm.AcknowledgeMotivation" "Not=To" Normal operation, With an Action "Persistent Event" for longer than 30 minutes. Based on those conditions I was going to execute a script to "Generate a Warning in the Banner" to let the NOC know there are alarms requiring attention greater than 30 mins.
Writing a script looked easy until I couldn't work out the correct type or namespace.
Firstly, Is this possible?
Is there another way to highlight alarms that have not been acknowledged in a timely fashion, e.g. 30 minutes?
Hi Nathan,
I believe the best solution for this would be a connector that subscribes on the alarms you want to consider, keeps track on the 'acknowledgement' states they way you want and has a parameter 'Pending Acknowledgements waiting more 30 min' or however you want to call this 'state' parameter. Based on this parameter you can then easily configure the warnings via an alarm template and get them displayed in the Cube banner. You can also configure other notifications based on this alarm if you want (email, alerter, ...) .
Alternatives via Correlation might be a bit impactful (depending on the alarm load of your system), since you'll have to trigger an automation on every alarm that impacts the summary state and you'll probably end up with a correlated alarm with a lot of updates, etc.
Scheduler could also be an option, but then you'll have some trouble generating the alarm you want in your Cube banner, I believe.
Hope I understood your request well and my reply helps you moving forward.