advertisement
16
Managing alerts
NOTE: You can receive alert notifications from OpenManage Essentials on your Android or iOS device by installing and
setting up the OpenManage Mobile application. For more information, see OpenManage Mobile Settings
and the
OpenManage Mobile User’s Guide
at dell.com/OpenManageManuals.
With OpenManage Essentials you can:
• View alerts and alert categories
• Manage alert actions
• Configure alert log settings
• Manage MIB files
• Manage traps
Viewing alerts and alert categories
To view the alerts page, from OpenManage Essentials, click Manage → Alerts .
NOTE: Alerts for deleted devices are not displayed in the console. However, these alerts are not deleted from the database until the purge limits are reached.
Viewing alert logs
To view alert logs, click Manage → Alerts → Alert Logs .
Understanding alert types
Table 183. Alert types
Icon
Figure 29. Normal alert icon
Alert
Normal Alerts
Description
An event from a server or a device that describes the successful operation of a unit, such as a power supply turning on or a sensor reading returning to normal.
An event that is not necessarily significant, but may indicate a possible future problem, such as crossing a warning threshold.
Figure 30. Warning alert icon
Warning Alerts
Figure 31. Critical alert icon
Critical Alerts A significant event that indicates actual or imminent loss of data or loss of function, such as crossing a failure threshold or a hardware failure.
An event has occurred but there is insufficient information to classify it.
Figure 32. Unknown alert icon
Unknown Alerts
Information Alerts Provides information only.
Figure 33. Information alert icon
243
Viewing internal alerts
Before viewing internal alerts, ensure that you enable internal health alerts in the Alert Settings of the Settings tab. See
To view internal alerts, click Manage → Alerts → Alert Logs → All Internal Alerts.
The All Internal Alerts filter is a reference to the internal alerts that OpenManage Essentials generates when a change occurs in the global health or connection status of a managed device.
Viewing alert categories
To view alert categories, click Manage → Alerts → Alert Categories .
The predefined alert categories are listed in alphabetical order.
Viewing alert source details
To view an alert category, in the alert categories list, expand an alert category, and then select an alert source.
NOTE: You cannot create a new event source.
For example, expand Environmental alert category and then select the alertCoolingDeviceFailure alert source.
Alert source values and descriptions for alertCoolingDeviceFailure
Table 184. Alert source values and descriptions for alertCoolingDeviceFailure
Field Name
Name
Type
Catalog
Severity
Value alertCoolingDeviceFailure
SNMP
MIB — 10892
Critical
Description
An SNMP alert based source.
If this alert is received, then the system is in critical state and immediate action is required.
Format String
SNMP Enterprise OID
SNMP Generic Trap OID
SNMP Specific Trap OID
$3
.1.3.6.1.4.1.674.10892.1
6
1104
Viewing previously configured alert actions
This section provides instructions to view previously configured alert actions.
Viewing application launch alert action
1.
Select Manage → Alerts → Alert Actions .
2.
In Alert Actions , select Application Launch .
Viewing email alert action
1.
Select Manage → Alerts → Alert Actions .
2.
In Alert Actions , select Email .
244
Viewing alert ignore action
1.
Select Manage → Alerts → Alert Actions .
2.
In Alert Actions , select Ignore .
Viewing alert trap forward action
1.
Select Manage → Alerts → Alert Actions .
2.
In Alert Actions , select Trap Forwarding .
Handling alerts
Flagging an alert
After you have completed action on an alert, flag the alert as acknowledged. Acknowledging an alert indicates it is resolved or does not require further action as a reminder to yourself. To acknowledge alerts:
1.
Select Manage → Alerts → Alert Logs .
2.
Click the alert you want to acknowledge.
NOTE: You can acknowledge multiple alerts simultaneously. Use <Ctrl> or <Shift> to select multiple alerts.
3.
Right-click and click Acknowledge → Set → Selected Alerts or Filtered Alerts .
If you choose Selected Alerts , the highlighted alerts are acknowledged.
If you choose Filtered Alerts , all alerts in the current filter/view are acknowledged.
Creating and editing a new view
To personalize the way you view alerts, create a new view or modify an existing view. To create a new view:
1.
Click Manage → Alerts → Common Tasks → New Alert View Filter .
2.
In Name and Severity Association , enter a name for the new filter, and then check one or more severities. Click Next .
3.
In Categories and Sources Association , assign the alert category or source to which you want to associate with this view filter and click Next .
4.
In Device Association , create query for searching devices or assign the device or device groups, which you want to associate to this view filter and then click Next .
5.
(Optional) By default the alert view filter is always active. To limit activity, in Date Time Association , enter a date range, time range, or days, and then click Next .
6.
(Optional) In Acknowledged Association , set duration when this alert action is active, and then click Next . The default is always active.
7.
In Summary , review inputs and click Finish .
Configuring alert actions
Alert actions occur on all alerts received by the OpenManage Essentials console. The alert is received and processed by the
OpenManage Essentials console whether or not OpenManage Essentials has discovered the device so long as OpenManage
Essentials is listed in the device's SNMP trap forward destinations list. To prevent this, remove OpenManage Essentials from the
SNMP trap forward destinations list on the device.
Setting up email notifications
You can create email notifications when an alert is received. For example, an email is sent if a critical temperature alert is received from a server.
245
To configure an email notification when alerts are received:
1.
Select Manage → Alerts → Common Tasks → New Alert Email Action .
2.
In Name and Description , provide email alert action name and description and then click Next .
3.
In E-mail Configuration , do the following and then click Next .
a. Provide email information for the To: and From: recipients and provide the substitution information. Separate each recipient or distribution list with a semi-colon.
b. Customize the email message format with any of the following substitution parameters:
• $n = Device
• $ip = Device IP
• $m = Message
• $d = Date
• $t = Time
• $sev = Severity
• $st = Service Tag
• $r = Recommended Resolution
• $e = Enterprise OID
• $sp = Specific Trap OID
• $g = Generic Trap OID
• $cn = Alert Category Name
• $sn = Alert Source Name
• $pkn = Package Name
• $at = Asset Tag
• $loc = Device Location
• $mod = Model Name c. Click Email Settings and provide SMTP server name or IP Address, to test email settings and click OK .
d. Click Test Action to send test email.
4.
In Severity Association , assign the alert severity to which you want to associate this email alert and then click Next .
5.
In Categories and Sources Association , assign the alert categories or alert sources to which you want to associate this email alert and then click Next .
6.
In Device Association , assign the device or device groups to which you want to associate this email alert and then click Next .
7.
By default the Email Notification is always active. To limit activity, in Date Time Association , enter a date range, time range, or days, and then click Next .
8.
In Summary , review the inputs and click Finish .
Related links
Ignoring alerts
Sometimes you will receive alerts you might want to ignore. For example, you may want to ignore multiple alerts generated when
Send authentication trap is selected within the SNMP service on the managed node.
NOTE: You can ignore all alerts from a particular device by using the Ignore All Alerts from Device option available when you right-click either a device on the device tree or an alert in the Alerts portal.
To ignore an alert:
1.
From OpenManage Essentials, select Manage → Alerts → Common Tasks → New Alert Ignore Action.
2.
In Name and severity Association , provide a name, assign the alert severity to which you want to associate this ignore alert action, and then click Next .
246
3.
In Categories and Sources Association , assign the alert categories source to which you want to associate this alert ignore action and then click Next .
4.
In Device Association , assign the device or device groups to which you want to associate this alert ignore action and then click
Next .
5.
By default the Ignore Alert is always active. To limit activity, in Date Time Association , enter a date range, time range, or days, and then click Next .
6.
In Duplicate Alert Correlation , select yes to exclude duplicate alerts received within the set time limit, and then click Next .
7.
In Summary , review inputs and click Finish .
Running a custom script
In response to a specific alert received, you can run custom scripts or launch a specific application. This file must be present on the
OpenManage Essentials service tier system (where OpenManage Essentials is installed) and not on the client browser system. For example:
• If you receive a temperature warning, you can use a custom script to create an incident ticket for your internal Help Desk.
• If you receive an MD Array storage alert, you can launch the Modular Disk Storage Manager (MDSM) application to view the status of the array.
Creating a custom script
1.
Select Manage → Alerts → Alert Actions .
2.
In Alert Actions , right-click Application Launch and select New Alert Application Launch Action .
3.
In Name and Description , provide an application launch name and description and then click Next .
4.
In Application Launch Configuration , provide an executable name (provide an absolute file path, for example, C:\ProgramFiles
\Dell\Application.exe
) and provide the substitution information, and then click Next .
5.
In Severity Association , assign the alert severity to which you want to associate this alert application launch and then click
Next .
6.
In Categories and Sources Association , assign the alert categories or alert sources to which you want to associate this alert application launch and then click Next .
7.
In Device Association , assign the device or device groups to which you want to associate this alert application launch and then click Next .
8.
By default the Application Launch Action is always active. To limit activity, in Date Time Association , enter a date range, time range, or days, and then click Next .
9.
In Summary , review inputs and click Finish .
Related links
Forwarding alerts
You may want to consolidate alerts from multiple management stations to one management station. For example, you have management stations in multiple locations and you want to view status and take action from one central location. For information about the behavior of forwarded alerts, see
.
To create alert forwards:
1.
Select Manage → Alerts → Common Tasks → New Alert Trap Forward Action.
2.
In Name and Description , provide Trap Forward name and description and then click Next .
3.
In Trap Forwarding Configuration , provide destination host name or IP address, provide community information, to send a test trap to the destination management station, click Test Action . To forward the trap in the same format to the configured destination, click Forward Trap in Original Format and click Next .
4.
In Severity Association , assign the alert severity to which you want to associate this trap forwarding alert and then click Next .
5.
In Categories and Sources Association , assign the alert categories source to which you want to associate this trap forwarding alert and then click Next .
247
6.
In Device Association , assign the device or device groups to which you want to associate this trap forwarding alert and then click Next .
7.
By default the Trap Forward Action is always active. To limit activity, in Date Time Association , enter a date range, time range, or days, and then click Next .
8.
In Summary , review inputs and click Finish .
The severity status for any trap is set to normal and for a successful alert action, combination of severity, category, and device has to confer with the selections in the preceding steps.
Forwarding alerts use case scenarios
This section describes scenarios about forwarding alerts using the SNMP v1 and SNMP v2 protocols. The scenarios consists of the following components:
• Managed node with an SNMP v1 agent, referred to as MNv1
• Managed node with an SNMP v2/v2c agent, referred to as MNv2
• Managed station 1 with OpenManage Essentials, referred to as MS1
• Managed station 2 with OpenManage Essentials, referred to as MS2
• Managed station 3 with a third-party software, referred to as MS3
Scenario 1 — Forwarding Alerts in the Original Format Using SNMP v1 Protocol
In this scenario, SNMP v1 alerts are sent from MNv1 to MS1 and then forwarded from MS1 to MS2. If you try to retrieve the remote host of the forwarded alert, it displays the name of MNv1 as the alert originates from MNv1. MNv1 is displayed because the SNMP v1 alert standards allow you to set the agent name in the SNMP v1 alert.
Scenario 2 — Forwarding Alerts in the Original Format Using SNMP v2/v2c Protocol
In this scenario, SNMP v2 alerts are sent from MNv2 to MS1 and then forwarded from MS1 to MS3. If you try to retrieve the remote host of the forwarded alert from MS3, it is displayed as MS1
Since there are no fields in an SNMP v2 alert to specify the agent name, the host which sends the alert is assumed as the agent.
When an SNMP v2 alert is forwarded from MS1 to MS3, MS1 is considered as the source of problem. To resolve this issue, while forwarding SNMP v2 or v2c alerts, a varbind is added with OID as .1.3.6.1.6.3.18.1.3.0 with the variable value as Agent Address . This has been set based on the standard OID specified in RFC2576-MIB. When you try to retrieve the Agent Address from MS3, it is displayed as MNv2
NOTE: If the SNMP v2 alert is forwarded from MS1 to MS2, the remote host is displayed as MNv2 because MS1 parses the extra OID along with the forwarded trap.
Scenario 3 — Forwarding Alerts in the OMEssentials Format Using Either SNMP v1/v2 Protocol
In this scenario, SNMP v1 alerts are sent from MNv1 to MS1 and then forwarded to MS2. If you try to retrieve the remote host of the forwarded alert, it is displayed as MS1. The severity and the message of the alert is also defined by MS1 and does not display the original severity and message defined by MNv1.
NOTE: The same behavior applies for SNMPv2 traps.
Working with sample alert action use cases
Sample alert actions are available for the Application Launch, E-mail, Ignore, and Trap Forwarding alert actions. Sample alert action use cases are disabled by default.
To enable a sample use case, right-click the use case and select Enable .
Use cases in alert actions
Application Launch
Sample - Run Script on Server Critical Alert —Enable this use case to run a custom script when a critical alert is received.
248
• Sample - Email Alerts to Service Desk —Enable this use case to send an e-mail to the service desk account from the
OpenManage Essentials server when an alert criteria is matched.
• Sample - Email Critical Server Alerts to Admin —Enable this use case to send an e-mail to an administrator from the
OpenManage Essentials server when an alert criteria is matched.
Ignore
• Sample - Ignore Alerts During Maintenance Window —Enable this use case to ignore alerts during a specified time interval.
• Sample - Ignore Duplicate Alerts with 15s —Enable this use case to ignore duplicate alerts from the same system.
• Sample - Ignore Non-Critical Alerts from Printers —Enable this use case to ignore non-critical alerts related to printers.
Trap Forwarding
Sample - Forward Critical Server Alerts to Other Monitoring Console —Enable this use case to forward SNMP alerts another monitoring console.
Configuring alert log settings
You can configure alert log settings to set the maximum size of alert logs; to generate a warning alert when the alert log reaches a set threshold, and to purge the alert logs. To modify the default settings:
1.
Select Manage → Alerts → Common Tasks → Alert Log Settings.
Alert Log Settings window is displayed.
2.
Enter a value or use the increment/decrement arrow buttons to increase or decrease the value of the following fields: a.
Maximum size of Alert Logs b.
Log a warning when the Alert Log size reaches c.
When the Alert Logs reach the Maximum size, purge
NOTE: The default maximum size of alert logs is 40,000 alerts. Once that value is reached, the older alerts are purged.
3.
Select Save purged Alerts to save the purged alert logs in .csv format.
4.
Enter the Purged Alerts Location .
5.
Click Finish.
The Alert Log Settings are configured and the specified Alert Logs are purged when the Maximum size is reached. The status of
Alert Logs purging task is shown under Logs → Application Logs .
Renaming alert categories and alert sources
1.
Click Manage → Alerts → Alert Categories .
2.
In Alert Categories , right-click any of the alert categories (under the Alert Category heading in the left pane) and select
Rename .
3.
Provide a name for the alert category and click OK .
Alert pop-up notifications
The alert pop-up notification is displayed in the bottom-right corner of the OpenManage Essentials console when a Critical or
Warning alert is received. The information displayed in the alert pop-up notification varies based on the number of alerts received.
If only one alert is received, the following information is displayed:
• Alert type — Warning or Critical.
• Name of the device that generated the alert.
• Alert description.
• View Alert — To view the Alert Details window.
• Go to Device — To navigate to the device in the device tree.
• Disable — To disable alert pop-up notifications.
249
If more than one alert is received, the following information is displayed:
• Alert type and frequency.
• Name of each device as a link to navigate to the device in the device tree.
NOTE: The device link is displayed only for the first three alerts.
• View Alerts — To view the All Recent Warning and Critical Alerts window.
• Go to Alert Console — To navigate to the Alerts portal.
• Disable — To disable alert pop-up notifications.
By default, the alert pop-up notification is enabled. You can configure OpenManage Essentials to disable alert pop-up notifications or set the time interval between each alert pop-up notification.
NOTE: The Alert Pop-up Notification Settings is user-specific. The settings you have configured is not applicable to other users.
Related links
Configuring alert pop-up notifications
Enabling or disabling alert pop-up notifications
Configuring alert pop-up notifications
1.
Click Settings → Alert Settings .
The Alert Settings page is displayed.
2.
Under Alert Popup Notification Settings , select or clear Enable Alert Popup Notifications to enable or disable alert pop-up notifications.
3.
In the seconds between popup notifications box, select the time interval between each pop-up notification.
4.
Click Apply .
Related links
Enabling or disabling alert pop-up notifications
To enable or disable alert pop-up notifications:
NOTE: To quickly disable alert pop-up notifications, click the Disable link displayed in the alert pop-up notification. When the Disable Alert Popup Notifications prompt is displayed, click Yes.
1.
Click Settings → Alert Settings .
The Alert Settings page is displayed.
2.
In Alert Popup Notification Settings :
• Select the Enable Alert Popup Notifications option to enable alert pop-up notifications when a Warning or Critical alert is received.
• Clear the Enable Alert Popup Notifications option to disable alert pop-up notifications.
3.
Click Apply .
Related links
Managing MIB files
OpenManage Essentials provides support for formatting hardware alerts (SNMP traps) for most enterprise devices. If you have non-
Dell devices, you can use the Alerts portal to define new alerts for OpenManage Essentials. Defining alerts allows OpenManage
Essentials to monitor a wider range of hardware and set up email and forwarding rules for these devices.
The Alerts portal allows you to extract trap definitions from SMIv1 or SMIv2 management information base (MIB) files. The extracted traps can be viewed and edited before importing them to OpenManage Essentials. This utility also allows you to manually
250
define and manage traps. Using the imported and manually-managed trap definitions, OpenManage Essentials properly classifies the incoming trap from a specific device.
NOTE: Importing traps portal is optional and only needed for formatting alerts from non-Dell devices.
About importing MIBs
Use case scenario : As an administrator you want to monitor (listen and classify incoming traps) a device that is not supported by
OpenManage Essentials.
Solution : Verify whether the device supports SNMP protocol. If the device supports SNMP protocol, ensure that the service is running and the trap destination points to the OpenManage Essentials-based system. For unsupported device traps, define the traps in OpenManage Essentials by importing the trap definitions using the Alerts portal. The following table provides information about traps before and after they are imported to the OpenManage Essentials database.
Table 185. Importing MIBs
Feature
Can I see traps coming from the device in the OpenManage Essentials alerts portal?
Before Importing the MIB to the
OpenManage Essentials Database
Yes
Will traps have a severity value?
Will traps have a valid name?
No, the severity is unknown.
No, the name is unknown.
After Importing the MIB to the
OpenManage Essentials Database
Yes
Yes
Yes, the trap name is defined in the MIB.
Will traps have a valid event category name?
Will traps have a description?
No, the event category name is unknown. Yes, a new category is created by default.
Will the trap display the trap variable values?
Yes, all the description details are present.
However, the details are not formatted.
Yes, the description is present in the format defined while importing the trap.
Yes Yes (by default), provided the format string values are not removed prior to importing the traps to OpenManage
Essentials.
Yes Will the trap display the Enterprise object identifier (OID), Specific OID, and Generic
OID?
Yes
Will the trap display additional trap variables which can be used for debugging?
Will the trap display the host name or IP address of the device?
Yes, however, the details are not formatted.
Yes
Yes
Yes
Can I use traps in various alert actions to forward the trap to another management console, execute a task, or filter the unwanted traps?
Can I perform various UI actions
(acknowledge, delete, and so on) on the traps?
Yes, but the features are limited. Rules specific to severity, event category, event name, and so on are not possible.
Yes, the traps are defined so all the alert actions are supported based on the trap name, category, severity, and so on.
Yes Yes
Will purging of alerts work on the traps?
Yes No
251
Importing MIBs
Before you begin, ensure that you are logged in with OmeAdministrator privileges.
1.
Click Manage → Alerts → Manage MIBs .
2.
In Manage MIBs , click Import MIB .
3.
In Select files for upload , click Browse .
a.
Select the MIB files that you want to import.
b.
Click Open .
4.
From the Select a MIB File list, select a MIB file and then click Parse MIB .
The trap data appears in a grid format.
5.
Click Import Traps to import traps into the OpenManage Essentials database.
Removing MIBs from OpenManage Essentials
Removing MIBs from OpenManage Essentials impacts the associated alert actions and existing alerts in the console.
Before you begin, ensure that you are logged in with OmeAdministrator privileges.
1.
Click Manage → Alerts → Manage MIBs .
2.
In Manage MIBs , click Remove MIB .
3.
Select the MIBs in the Imported MIBs .
4.
Click Remove MIB .
Managing traps
Customizing trap definitions
The Custom Trap Definitions view enables you to add trap definitions to the OpenManage Essentials database. You can add a new trap definition or search unknown traps received in OpenManage Essentials, define the trap details and add the trap.
NOTE: When you use the Unknown Traps button to add unknown traps received in OpenManage Essentials, the
Enterprise OID, Generic ID and Specific ID fields are automatically populated.
Before you begin, ensure that you are logged in with OmeAdministrator privileges.
To add traps:
1.
Click Manage → Alerts → Manage Traps .
2.
In Manage Traps , click Custom Trap Definitions .
The Custom Trap Definitions view is displayed.
3.
If you want to add a new trap definition: a. In the Category Name list, select an existing category or type a new category name.
b. Provide the Trap Name , Description , Enterprise OID , Specific ID , and Format String .
c. In the Severity list, select a severity level for the trap.
4.
If you want to add an unknown trap received in OpenManage Essentials: a. Click Search Unknown Traps .
The Unknown Traps in OpenManage Essentials window is displayed.
b. Select an unknown trap you want to define and add and click OK .
The Enterprise OID , Generic ID and Specific ID fields are populated automatically based on the selected unknown trap.
c. In the Category Name list, select either an existing category or type a new category name.
d. Provide the Trap Name , Description , and Format String .
e. In the Severity list, select a severity level for the trap.
5.
Click Add Trap .
The trap details you provided are displayed in the User-defined Traps grid.
252
Deleting traps
The Custom Trap Definitions view also enables you to delete user-defined traps. Traps that are pre-defined in OpenManage
Essentials cannot be deleted.
Before you begin, ensure that you are logged in with OmeAdministrator privileges.
To delete traps:
1.
Click Manage → Alerts → Manage Traps .
2.
In Manage Traps , click Custom Trap Definitions .
3.
In the User Defined Traps grid, select the traps you want to delete.
The selected traps are highlighted
4.
Click Delete Trap .
The confirmation dialog box is displayed.
5.
Click Yes .
Resetting built-in trap definitions
The Reset Built-in Trap Definitions view enables you to reset a pre-defined OpenManage Essentials trap that you edited earlier.
Before you begin, ensure that you are logged in with OmeAdministrator privileges.
To revert traps:
1.
Click Manage → Alerts → Manage Traps .
2.
In Manage Traps , click Reset Built-in Trap Definitions .
The Revert Trap view displays all the pre-defined trap definitions that you edited.
3.
In the Edited Traps grid, select the traps you want to revert and click Revert Traps .
The confirmation dialog box is displayed.
4.
Click Yes .
Configuring SNMPv3 traps
The latest version of OpenManage Essentials supports SNMPv3 traps. The SNMPv3 traps offer enhanced security than V1/V2c
.
To configure SNMPv3 traps:
1.
Select Manage → Alerts → Common Tasks → SNMP V3 Trap Configuration.
SNMP V3 Trap Configuration window is displayed.
NOTE: The SNMPv3 trap configuration details are automatically populated for the devices discovered using the
SNMPv3 protocol. To receive the SNMPv3 traps, enable SNMPv3 trap listener under Settings → Alert Settings.
2.
Enter the details in the following columns for the devices discovered using SNMP V1/V2c or WSMAN protocols:
NOTE: The details in the SNMP V3 Trap Configuration window can be edited only if Support V1/V2c/V3 Traps is selected under Alert Settings → SNMP Listener Settings. If Support V1/V2c is selected, then you can view the details only.
a. Username b. Authentication Protocol c. Authentication Password d. Encryption Protocol e. Encryption Password
3.
To configure the SNMPv3 trap manually: a. Click Add New .
SNMP V3 Trap Configuration window is displayed.
b. Enter the details in the following fields:
253
• Agent IP Address
• Engine ID
• Username c. Select the Authentication Protocol from the list.
NOTE: SHA1 is the authentication protocol selected by default.
d. Enter the Authentication Password .
e. Select the Encryption Protocol from the list.
NOTE: AES is the encryption protocol selected by default.
NOTE: If the Authentication Protocol is set to None, then the authentication and encryption options are disabled.
f. Click OK .
The configured SNMPv3 trap profile is displayed in the SNMP V3 Trap Configuration window.
4.
Alternatively, to import the .csv file containing the credentials: a. Click Export to generate a sample .csv file.
b. Save the file to your system, and populate the Agent IP Address, Engine ID, Username, Authentication Protocol,
Authentication Password, Encryption Protocol, and Encryption Password fields in the .csv file.
c. Click Import to import the .csv file.
The imported credentials are displayed in the SNMP V3 Trap Configuration window.
254
advertisement