Alert not firing

I would suggest changing the Comparing line in the alert.  Change it to greater than > and the number of seconds you want to check for.

Example:  > 3600  means has not received in 60 minutes (60×60).

Your duration should be fine.  It just means that the condition must hold true for the specified period of time.

Only other thing I can caution you on for LastR alerts is if you are resetting stats in the night or whenever (hcimsiutil -Z), that clears the alert ‘memory’ of when the last message actually was received, and can cause false alerts on threads that don’t see steady flow.  To get around this sort of thing, set the time window appropriately.  Example – if you want an alert to trigger if you haven’t received in 2 hours, and you reset your stats at 1am, set the alert window to start at 3am.  It should alert right at 3am if nothing is received.  But if you don’t have this time window, you could potentially see false alerts around 1am when stats are reset.

Here’s an example of one of our last received alerts.

{VALUE lastr} {SOURCE {intelus_p01_in idx_bor_in}} {MODE actual} {WITH -2} {COMP {> 10800}} {FOR {nmin 5}} {WINDOW {* * 8-18 * * 1-5}} {HOST {}} {ACTION {{exec {vm_alert.script “%A”}}}}

It watches two threads and triggers if we haven’t received anything in 3 hours and stays true for 5 minutes. It works flawlessly. (In fact too flawlessly this past Memorial day)

The other thing you might want to check is the hcimonitord.log to see if it errored while loading at the top of the log. And then also see if there were any problems around the time it was supposed to fire.

Hope this helps,

-mh

Hello,

What do you do when last receive is ‘Never’? it seems to not count that as time, and I can not figure out how to put lastr =  ‘Never’

Is the answer that you have to put a periodic keep alive-dummy message through?

Thanks,

Julie

That would cause the alert to fire at start up.

Are you sure that’s what you want to do?

No,

I thought that I would try to have it check it every 60 minutes…but maybe that would happen at start up, too.

My problem is that I have an incoming connection…that for some unfindable reason, they lose connection to us. Our Cloverleaf perspective says ‘up’ , and it seems to remedy matters if I bounce that connection.

I have an alert that bounces if it has not read in over an hour, but the problem is if it bounces, and there is nothing yet to read, and then if it goes down again…it will never bounce again because lastread says ‘Never’.

I am basically having to baby sit this connection in case that occurs.

What this alert does is…

If I haven’t received something in x amount of time, do something.

So you’ll want to set up your alert like the example above

but make COMP > 3600 for 1 hour. Then exec a script that bounces the connection.

Chances are when you are executing your bounce script that the script is also looking at the msi stats of the interface and deciding whether to go ahead and bounce or not.

Since you already know that you’ve been an hour without receiving something, you’ll want to bounce without the script checking too.

thanks for your replies,

but acually I am not checking the msi …. just a batch file to pstop, pause, pstart. (on windows)

I imagine that I probably will have to add a different alert that will look into the msi settings…

I see that msi setting PLASTREAD is equall to 0 when it states ‘never’…so I guess something around that might work.

Hi

I am having the same problem with this alert

It works just fine when the last receive is some time

but when the last receive is ‘Never’ or / internally PLASTREAD=0/ I can not make my alert to fire

it doesn’t count that as time, and I can not figure out how to put lastr condition

Does anybody have a solution for this?

Thanks

For our lastr alerts, we use the “delta” mode instead of actual.  This seems to work for us here and we have no issues with the alerts firing.

Thanks…..Tom