Alert type AND and checking for holidays

[Peter Heggie]

Hi Everyone, I’m looking for some sanity checking.

Thinking of creating an AND type alert, with a ‘normal’ alert like thread status, connected to a tcl alert, which runs code that opens a ‘holiday’ file and determines if today’s date is mentioned in the holiday file.

The tcl alert returns 1 if today is a holiday or 0 if it is not.

The new AND alert includes the tcl holiday check alert as a NOT condition.

So if we are not getting any charges from our billing coders, we are not going to fire off alerts every 30 minutes if it is a holiday.

Another scenario is for outages – if our main system goes offline, maybe for daylight savings time, we can AND together our main ADT feed alerts with an ‘outage’ tcl alert. This way we can set a flag in one place and not require our overnight operations staff to update multiple alerts. When we have a planned outage for off hours, or even an unplanned outage that we know will take some time to recover from, we or someone in Operations can set one flag instead of trying to disabled multiple alerts that may not be clearly identified as tied to an outage, and not have to remember to restart the monitor daemon.

But how does notification work – if we AND together a ‘regular’ alert and a holiday check alert, and there is a problem and it is not a holiday, does the notification come from the AND alert, or the ‘regular’ alert or the TCL alert? If it is not the regular alert, then we have to create an AND pairing of alerts for each ‘regular’ alert. Off the top of my head I think that is messy.

Thoughts?

Peter

Peter Heggie

Topic

[Connie Kraska]

I like your idea of using the AND alert.  I use an alternate alert file for holidays.  I’d like to experiment with your idea and would appreciate getting a copy of your Tcl and holiday file.

Thanks

[Max Drown (Infor)]

That’s a great idea, Peter. Please do share your solution.

-- Max Drown (Infor)

[Peter Heggie]

I’m playing with it now and finding that it is not quite what I hoped I could do.

If I have a thread last read alert, to trigger every 5 minutes, when no messages are received, with an email action, I will get the email every 5 minutes.

If I create a tcl alert that checks the holiday file and finds that today is not a holiday, it will fire an alert.

If I create an AND alert that combines the two, it will fire an alert if the combined condition is true.

I guess what I wanted is for the thread last read alert to only fire if the AND condition is true ( no messages and no holiday).

To do that, I need to remove the ACTION on the thread last read alert (or set the action to NONE) and put the desired ACTION on the AND thread.

So thats fine, it accomplishes the goal, but it also means that for every ‘real’ alert, like a thread last read alert, I also need a separate AND alert to also check the holiday file.

So the result is doubling the number of alerts defined, plus the holiday tcl alert (or any other special alert, like an ‘outage’ alert).

Is it a lot to ask for an enhancement to Alerts to add the AND function right into an existing alert instead of creating a separate class of alerts?

I will post the code for the holiday alert here:

Code:

######################################################################
#
# Name:      alerts_holiday_check
# Purpose:   return a 1 if today is a holiday and a 0 if it is not
#
# UPoC type: alert tcl
#
# Returns:   1 for yes or 0 for no
#
# History:   2014/12/15 PCH created
#                

proc alerts_holiday_check { args } {

 set debug 1
 set module “alerts_holiday_check:”
 if {$debug > 1} {echo “$module debug”}

 # read holiday file
 set directory [hcitbllookup “alert_parms” “alerts_override_directory”]
 set holidayfile [hcitbllookup “alert_parms” “holiday_file”]
 set holidaypath “$directory/$holidayfile”
 if {$debug > 1} {echo “$module holidaypath: $holidaypath”}

 # read in holiday file
 set hfile [open $holidaypath r]
 set filedata [read $hfile]
 close $hfile

 set today [clock format [clock seconds] -f “%Y-%m-%d”]
 if {$debug > 1} {echo “$module today: $today”}

 set lines [split “$filedata” “n”]
 foreach line $lines {
   if {$debug > 2} {echo “$module line: $line”}
   set date [string range “$line” 0 9]
   if {$date eq $today} {
     set holiday [string range “$line” 11 end]
     if {$debug} {echo “[gts] $module today is a holiday: $holiday”}
     set returnList {} ; lappend returnList “VALUE 1” ; return $returnList
   }
 }

 if {$debug > 1} {echo “[gts] $module today is not a holiday”}
 set returnList {} ; lappend returnList “VALUE 0” ; return $returnList
}

Here is a holiday file sample:

2014-12-15 petes day

2014-12-25 Christmas

2015-01-01 New Years Day

Here is a sample alert_parms.tbl table:

# Translation lookup table

#

prologue

   who: peterheggie

   date: December 16, 2014 1:38:27 PM EDT

   outname: output

   inname: input

   bidir: 0

   type: tbl

   version: 4.0

end_prologue

#

dflt_passthrough=0

dflt=

dflt_encoded=false

#

debug

1

encoded=0,0

#

env

Live

encoded=0,0

#

email_from

cloverleaf@crouse.org

encoded=0,0

#

alerts_override_directory

../../data/alerts

encoded=0,0

#

outage_file

outage

encoded=0,0

#

holiday_file

holidays

encoded=0,0

#

Peter

Peter Heggie

[Max Drown (Infor)]

You should definitely ask for an AR. That’s a great idea.

-- Max Drown (Infor)

[Bob Richardson]

Greetings,

We played with the AND alert under 5.8.7 and found that the alerts have to be stacked in the exact order that you want them tested BEFORE the AND alert.   The AND alert resets every 2 minutes.  And echoes an entry into the alerts.log file (under 5.8.7) but is now supposed to just dump that echo into the hcimonitord.log file instead (not a solution just a redirection).

For what’s it worth:  the Last Read and Last Write type alerts only reset when the CONDITION changes, that is, when a message is received or sent.  Not when a thread is cycled. or alrt file reloaded.

Just some feedback to help you debug your solution.

Good luck!   The Integrator needs a Holiday filter capability in the Alerts.

[Author]

Replies