source list – triggering thread in alert

[Bob Schmid]

is there a variable that communicates to the action item which thread is the offending thread?

Topic

[Keith McLeod]

Are you looking for the % variables used in alerts. Or simply the source info when alerting.

I tend to use the %A and extract out what I use in my own output for email or helpdesk ticket purposes.  See Attachment.

[Levy Lazarre]

Indeed, there is a variable that indicates the name of the offending thread: %T

However, if multiple threads are involved in the same alert, %T will contain a comma-separated list of thread names.

Ultimately, I found it safer to do like Keith and parse the alert text (%A) to find the name of the single thread I am interested in. This is because Cloverleaf will send a ‘%A’ for each thread involved.

I hope this helps.

[Keith McLeod]

One consideration to watch out for is that the number of threads in your source can change the value in %A.  I actually had 3 different states for the same configuration with different number of source threads.  I did work through it to get the information I needed, but still wonder if there are other variations of the %A variable with the same configurations.

1) Action: proto_disc_multiple “Thread protocol status of vericis_ord_out has been opening  for 2700 seconds”

2) Action: proto_disc_multiple “Thread protocol status of at least 1 of (labworks_adt_in,labworks_adt_out,labworks_ord_in) has been opening  for 2700 seconds”

3) Action: proto_disc_multiple “Thread protocol status of at least 1 of (apollo_ads_out,apollo_adt_out,apollo_lab_out,apollo_res_out,apollo_trans_in) has been up  for 2700 seconds”

3 puzzles me since it was a copy of the others with the source changed.

Source count at least 1

== opening

Duration 45 Minutes

Review the alerts.log file for what you are receiving… Hope this helps.

[Levy Lazarre]

Keith,

I am curious. I haven’t seen this type of ‘%A’ syntax because when we have multiple threads in the source, we tend to use a “Source Count” of “any”. Also we check the box “Thread Only”.

[Keith McLeod]

This particular alert requires that only one of the threads trigger the alert.  I then test all threads from the source for the connection and create a single ticket for the client listing all source connections showing the disconnect.

Example:

Description: At Sun Sep 23 01:24:52 EDT 2018, the cloverleaf network monitor has detected that connections between your system named LUMEDX APOLLO and CLOVERLEAF appear to be NOT CONNECTING.  On your system named LUMEDX APOLLO, please check the following connections:

apollo_adt_out – Can’t connect to 10.9.8.7:12345

apollo_ord_out – Can’t connect to 10.9.8.7:12346

apollo_res_out – Can’t connect to 10.9.8.7:12347

[Author]

Replies