Henrik, Thanks- do not understand yet but it might help.
Does this work on all items in the workflow i.e. each trap it receives? Alternatively, on a single alert? My other problem is the job name in the traps can be anything it is the job name in NetBackup so my other challenge is to match these random test items together. As I said, I really have SNMP traps. Peter Hakesley | Monitoring & Automation Technical Lead Engineer, Data Centre Services t: +44(0)845 155 6556 ext: 4006 e: phakes...@sccis.net | w: www.scc.com<http://www.scc.com/> a: SCC, CV1, Cole Valley, 20 Westwood Avenue, Tyseley, Birmingham B11 3RZ From: listsad...@lists.myitforum.com [mailto:listsad...@lists.myitforum.com] On Behalf Of Henrik Andersen Sent: 14/February/2017 11:20 To: msmom@lists.myitforum.com Subject: [msmom] SV: SNMP Alert Correlation Well, you can always use regular expressions with the System.ExpressionFilter Module. That will bring you much joy and happiness:) (at least, when you have found the correct pattern) Matthew did a great job explaining whar to do with the expressionfilter https://matthewlong.wordpress.com/2012/07/03/the-scom-unsung-hero-using-the-system-expressionfilter-module/ Venlig hilsen Henrik Andersen Server Operation Direkte +4563636158 Mobile +4521579037 h...@jndata.dk<mailto:h...@jndata.dk> [cid:image001.gif@01D286C8.6A986880] JN Data A/S · Havsteensvej 4 · 4000 Roskilde Telefon 63 63 63 63/ Fax 63 63 63 64 www.jndata.dk<http://www.jndata.dk> [cid:image002.gif@01D286C8.6A986880] Fra: listsad...@lists.myitforum.com<mailto:listsad...@lists.myitforum.com> [mailto:listsad...@lists.myitforum.com] På vegne af Pete Hakesley Sendt: 14. februar 2017 11:54 Til: msmom@lists.myitforum.com<mailto:msmom@lists.myitforum.com> Emne: [msmom] SNMP Alert Correlation Hi, I have a varbind5 which has all the description about the alert from NetBabackup. varbind5: Alert Raised on: 13 February 2017 18:24 Job: 552953 Tree Type : Server Tree Name : ALL MASTER SERVERS Nodes : NetBackupServer.domain.net Job Policy: JOB_POLICY_NAME Exit Status: 0 (the requested operation was successfully completed) Client: {SERVERNAME} New State: Done Alert Policy: JOB_SUCCESS OpsCenter Server: NetBackupServer Comment varbind6: JOB_SUCCESS I wish to correlate parts of this string e.g. Job Policy: XXXXXXXX The name of the Backup Trap for Exist Status > 1 Against Job Policy: XXXXXXXX The name of the Backup Trap for Exist Status 0 or 1 Varbind6 contain the NetBackup Alerts Policy from the OpsCenter Console e.g. JOB_FAILURE matched against a number of exit codes. JOB_SUCCESS matched against State 0 or 1 Can SCOM extract data from Strings in the rule and have a two state monitor kind of approach to a failure/Success trap. I am pulling my hair out as I hate SNMP traps. Peter Hakesley | Monitoring & Automation Technical Lead Engineer, Data Centre Services t: +44(0)845 155 6556 ext: 4006 e: phakes...@sccis.net<mailto:phakes...@sccis.net> | w: www.scc.com<http://www.scc.com/> a: SCC, CV1, Cole Valley, 20 Westwood Avenue, Tyseley, Birmingham B11 3RZ
