Reset Search
 

 

Article

Ridgeline doesn't send alarm mail for some events

« Go Back

Information

 
TitleRidgeline doesn't send alarm mail for some events
Symptoms
  • Ridgeline doesn't send alarm mail for some events link ELRP, SNMP, Invalid login,etc..

Environment
  • RL 4.0

Cause
Resolution
  • The “ELRP loop” trap has two definitions, one for Event (Default one) and another for Alarm (created by user). If we have both definitions configured, then Alarm is considered has parent and the Event is considered has child.  Irrespective of the configuration in Alarm definition, it will be considered only to be over ruled by priority which is parent. Since Alarm is updating Timestamp itself for every new “ELRP loop” trap, we will not get individual mail. However, when the Event is created newly, for every “ELRP loop” trap, we will get an individual mail. If you enable “ELRP alarm definition”, then ELRP alarm will be generated, but email will not send individually. If we notice the subject of the ELRP mail received, the email is getting generated based on Event only. When there is an intermittent/continuous ELRP loop occurring in the switch, it will not be aggregate when it is configured has "False" in “affectedEntity.xml” file. It means there will not be aggregated events. For aggregated events only once email alerts are sent. If we have associated a profile with email action to the ELRP Loop detected event definition then email will be sent on ELRP Loop detected trap for once. If user needs email every time, then event definition’s aggregate flag must be "False". By default the setting is "False".

  • The SNMP unreachable event is an NMS event, so it will not be listed in “affectedEntity.xml” file. By default all NMS events are not aggregated. Hence we cannot configure it for sending email alert for every SNMP unreachable aggregated event.

  • Events like Invalid login, Authentication failure etc. are by default to set to aggregate.
     For example:- If Invalid Login attempt trap comes repeatedly from same device then only Invalid Login  event will be created and the same event’s Timestamp will be updated afterwards for every consecutive Invalid Login attempt trap.Email will not be sent for aggregated events except for first event.

To disable event aggregation for “Invalid login” events.
Please follow the below steps to disable event aggregation for “Invalid login” event:
1.    Stop the server service.
2.    Goto <RL_install_Dir>\jboss\standalone\deployments\extreme.war.
3.    Open affectedEntity.xml
4.    Search for “Invalid Login” event.

5.    Change the attribute ‘aggregate’ value to ‘false’.
6.    Now start the server.

  • If you require more information, please contact GTAC for assistance.

 
Additional notes

Feedback

 

Was this article helpful?


   

Feedback

Please tell us how we can make this article more useful.

Characters Remaining: 255