Well, you can always use regular expressions with the System.ExpressionFilter Module. That will bring you much joy and happiness:) (at least, when you have found the correct pattern)
Matthew did a great job explaining whar to do with the expressionfilter https://matthewlong.wordpress.com/2012/07/03/the-scom-unsung-hero-using-the-system-expressionfilter-module/ Venlig hilsen Henrik Andersen Server Operation Direkte +4563636158 Mobile +4521579037 [email protected] [cid:[email protected]] JN Data A/S · Havsteensvej 4 · 4000 Roskilde Telefon 63 63 63 63/ Fax 63 63 63 64 www.jndata.dk [cid:[email protected]] Fra: [email protected] [mailto:[email protected]] På vegne af Pete Hakesley Sendt: 14. februar 2017 11:54 Til: [email protected] Emne: [msmom] SNMP Alert Correlation Hi, I have a varbind5 which has all the description about the alert from NetBabackup. varbind5: Alert Raised on: 13 February 2017 18:24 Job: 552953 Tree Type : Server Tree Name : ALL MASTER SERVERS Nodes : NetBackupServer.domain.net Job Policy: JOB_POLICY_NAME Exit Status: 0 (the requested operation was successfully completed) Client: {SERVERNAME} New State: Done Alert Policy: JOB_SUCCESS OpsCenter Server: NetBackupServer Comment varbind6: JOB_SUCCESS I wish to correlate parts of this string e.g. Job Policy: XXXXXXXX The name of the Backup Trap for Exist Status > 1 Against Job Policy: XXXXXXXX The name of the Backup Trap for Exist Status 0 or 1 Varbind6 contain the NetBackup Alerts Policy from the OpsCenter Console e.g. JOB_FAILURE matched against a number of exit codes. JOB_SUCCESS matched against State 0 or 1 Can SCOM extract data from Strings in the rule and have a two state monitor kind of approach to a failure/Success trap. I am pulling my hair out as I hate SNMP traps. Peter Hakesley | Monitoring & Automation Technical Lead Engineer, Data Centre Services t: +44(0)845 155 6556 ext: 4006 e: [email protected]<mailto:[email protected]> | w: www.scc.com<http://www.scc.com/> a: SCC, CV1, Cole Valley, 20 Westwood Avenue, Tyseley, Birmingham B11 3RZ
