Alternating Warning/Good Status

Harroguk · Post by **Harroguk** » Mon Jul 30, 2007 2:31 am

I have a small problem when monitoring the drivespace of one of our servers, we are trying to implement the "Warning" alerts which have not been used before by us.

We are aiming to set up the test to show "Bad" when the available space reaches 10%, to show "Warning" when the available space is between 10% and 20%, and to show as "Good" at all other times.

The problem we are encountering is that even though the drive space is consistantly 12% the alert is flagging up as "Warning" for 1 recurrence then flagging as "Good" for 1 recurence. This alternating between the two status' occurs continuously as long as the test is enabled.

Is there anything that I have missed in the configuration of this test?

This is the test we are running

Code: Select all

;-----------------------------------------------------------------------------
;- HostMonitor`s export/import file                                          -
;- Generated by HostMonitor at 30/07/2007 09:06:46                           -
;- Source file: C:\Program Files\HostMonitor6\newtest.hml                    -
;- Generation mode: Selected_Tests                                           -
;-----------------------------------------------------------------------------


; ------- Test #01 -------


Method      = UNC
;--- Common properties ---
;DestFolder = x.x.x.x\Infrastructure\Management Services\
Title       = Management Server 01 - Free Space on D:
Comment     = \\IPREMOVED\D$\
RelatedURL  = 
ScheduleMode= Regular
Schedule    = 
Interval    = 60
Alerts      = Message, Sound
ReverseAlert= No
UnknownIsBad= Yes
WarningIsBad= No
UseWarning  = Yes
WarningExpr = ("%SimpleStatus%"=="UP") and ("%Reply%">"10 %") and ("%Reply%"<"20 %")
UseNormal   = No
NormalExpr  = 
UseCommonLog= Yes
PrivLogMode = Default
CommLogMode = Default
;--- Test specific properties ---
UNC         = \\IPREMOVED\D$\
test        = totalfreespace
MinFreeSpace= 10%
username    = USERREMOVED
password    = PASSREMOVED

;-----------------------------------------------------------------------------
; Exported 1 items

Thanks for any help you can give.

Harro.

KS-Soft Europe · Post by **KS-Soft Europe** » Mon Jul 30, 2007 2:54 am

You have to use %SuggestedSimpleStatus% and %SuggestedReply% variables to make it wotk. Please, try the following expression:

Code: Select all

("%SuggestedSimpleStatus%"=="UP") and ("%SuggestedReply%">"10 %") and ("%SuggesstedReply%"<"20 %")

Your expression did not work because %SimpleStatus% actually was "Warning", not "UP". HostMonitor calculates expression in the following order:
* HostMonitor performs the test;
* processes "Reverse alert" option;
* sets "suggested" macro variables (%SuggestedStatus%, %SuggestedSimpleStatus%, %SuggestedReply%, %SuggestedRecurrences% and %FailureIteration%) without touching regular counters (%Status%, %Reply%, %Recurrences%, etc);
* then HostMonitor evaluates "Warning" and "Normal" expressions and finally modifies current test status and statistisc counters (Status, Reply, Alive%, Passed tests, Failed tests, etc).

Quote from the manual:
http://www.ks-soft.net/hostmon.eng/mfra ... .htm#macro
==========================
The following variables may be used in the expressions that define Normal and Warning statuses (see Optional status processing section of the manual).
These variables may be used as parameters of some actions as well, but usually this does not have sense.
%SuggestedStatus% Status that will be used for the test item, unless "normal" or "warning" options modify the status. Variable may return one of the following values: Host is alive, Ok, No answer, Bad, Bad contents, Unknown or Unknown host

%SuggestedSimpleStatus% Similar to %SimpleStatus% but provides information about "suggested" status (test probe already responded with some result but %Status%, %Reply% and other regular counters not modified yet)

%SuggestedReply% Represents reply value
%SuggestedRecurrences% Similar to %Recurrences% counter. Difference is HostMonitor sets this variable before Normal and Warning expressions processing. If you do not use optional status processing or both logical expressions return False, then %Recurrences% will be equivalent to %SuggestedRecurrences%

%FailureIteration% The number of consecutive failed test probes. Shows 0 when test returns "good" result.
In contrast to other counters (like %Status%, %Recurrences%, %CurrentStatusIteration%, %FailedCnt%, etc) that depend on result of optional status processing (Normal and Warning expressions), this counter always tells you about REAL result of test probe. E.g. when test returns "bad" status, HostMonitor increments this variable even if "Use normal status..." option tells HostMonitor to change test status to Normal.
See processing sequence for details
==========================

Regards,
Max

Harroguk · Post by **Harroguk** » Mon Jul 30, 2007 3:01 am

Works perfecty,

Thanks.

Harroguk · Post by **Harroguk** » Mon Jul 30, 2007 8:05 am

Another test giving me similar results.

Code: Select all

WarningExpr = (("%SuggestedSimpleStatus%" == "UP") and ("%SuggestedReply%" > "4") and ("%SuggestedReply%" < "49") and ("%SuggestedRecurrences%" > "4")) OR ("%SuggestedSimpleStatus%" == "Warning") and ("%SuggestedReply%" > "4") and ("%SuggestedReply%" < "49"))

The aim for for a monitored perf counter event to go into warning status if it provides results between 5 and 50 for 5 consecutive occurances. It is then to remain in Warning state until it drops back below 5. If the event goes above 50 then the state should change to bad.

I have set the Alert when value: to is > than 49

and am trying to use the string above to generate teh warning state however the state only stays as warning for 1x recurance before changing back to good.

Any help you can give is much appreciated.

Harro

KS-Soft Europe · Post by **KS-Soft Europe** » Mon Jul 30, 2007 8:32 am

Could you try the following expression? It should work:

Code: Select all

(("%SuggestedSimpleStatus%" == "UP") and ("%SuggestedReply%" > "4") and ("%SuggestedReply%" < "49") and ("%SuggestedRecurrences%" > "4")) OR (("%SimpleStatus%" == "DOWN") and ("%SuggestedReply%" > "4") and ("%SuggestedReply%" < "49"))

Regards,
Max

Harroguk · Post by **Harroguk** » Mon Jul 30, 2007 8:38 am

Still doesnt work, it is almost like it isnt processing the second half of the OR statment (The half that should match to the Warning/Down status).

KS-Soft Europe · Post by **KS-Soft Europe** » Mon Jul 30, 2007 8:47 am

Please note: foregoing expression will work only if "Treat Warning Status as Bad" option is enabled. If "Treat Warning Status as Bad" option is unmarked, you may try the following one:

Code: Select all

(("%SuggestedSimpleStatus%" == "UP") and ("%SuggestedReply%" > "4") and ("%SuggestedReply%" < "49") and ("%SuggestedRecurrences%" > "4")) OR (("%SimpleStatus%" == "WARNING") and ("%SuggestedReply%" > "4") and ("%SuggestedReply%" < "49"))

Regards,
Max

Harroguk · Post by **Harroguk** » Mon Jul 30, 2007 11:20 am

Finally got this working as I wanted,

Thanks for all the help.

KS-Soft Europe · Post by **KS-Soft Europe** » Mon Jul 30, 2007 11:28 am

Harroguk wrote:Finally got this working as I wanted

Great!

Could you post the final expression here ?

Harroguk wrote:Thanks for all the help.

You are welcome.

Regards,
Max

Harroguk · Post by **Harroguk** » Mon Jul 30, 2007 11:34 am

The exported test is below.

The important things as you said are to have the WarningIsBad = True with the WarningExpr as

Code: Select all

(("%SuggestedSimpleStatus%"=="UP") and ("%SuggestedReply%">"1.30") and ("%SuggestedReply%"<"1.60") and ("%SuggestedRecurrences%">"2") or ("%SimpleStatus%"=="Down") and ("%SuggestedReply%">"1.30") and ("%SuggestedReply%"<"1.60"))

Code: Select all

;-----------------------------------------------------------------------------
;- HostMonitor`s export/import file                                          -
;- Generated by HostMonitor at 2007-07-30 17:54:46                           -
;- Source file: C:\Program Files\HostMonitor6\CurrentSettings25thApril07Nat-Final.hml-
;- Generation mode: Current_Folder_And_Subfolders                            -
;-----------------------------------------------------------------------------

;-----------------------------------------------------------------------------
; Folder: FOLDERREMOVED
;-----------------------------------------------------------------------------
;You may comment the following line to import tests into current folder
;DefaultFolder  = FOLDERREMOVED

; ------- Test #01 -------

Method      = PerfCounter
;--- Common properties ---
;DestFolder = FOLDERREMOVED
Title       = SERVERREMOVED - Server Process Memory
Comment     = PerfCounter: \\IPREMOVED\Server_ProcMem
RelatedURL  = 
ScheduleMode= Regular
Schedule    = 
Interval    = 60
Alerts      = Server Process Memory Critical 
ReverseAlert= No
UnknownIsBad= Yes
WarningIsBad= Yes
UseWarning  = Yes
WarningExpr = (("%SuggestedSimpleStatus%"=="UP") and ("%SuggestedReply%">"1.30") and ("%SuggestedReply%"<"1.60") and ("%SuggestedRecurrences%">"2") or ("%SimpleStatus%"=="Down") and ("%SuggestedReply%">"1.30") and ("%SuggestedReply%"<"1.60"))
UseCommonLog= No
PrivLogMode = Default
CommLogMode = Default
;--- Test specific properties ---
PerfCounter = \\IPREMOVED\Server_ProcMem
Condition   = MoreThan
Value       = 1600000000.00
DisplayMode = BytesToGb

;-----------------------------------------------------------------------------
; Links
;-----------------------------------------------------------------------------

;-----------------------------------------------------------------------------
; Exported 1 items

Harroguk · Post by **Harroguk** » Tue Jul 31, 2007 6:33 am

OK then, no really sure why or what I have changed but today I tried to set up a similar test and am encountering the same problem (Correctly Flagged as "Good" for the first 2x recurrences, correctly flags as "Warning" for the next occurence of it, then flags as good again. Like I said before it is like it isnt processing the second half of the OR statement.

The source perf counter provides a steady response of 63

Code: Select all

;-----------------------------------------------------------------------------
;- HostMonitor`s export/import file                                          -
;- Generated by HostMonitor at 2007-07-31 13:26:39                           -
;- Source file: C:\Program Files\HostMonitor6\CurrentSettings25thApril07Nat-Final.hml-
;- Generation mode: Selected_Tests                                           -
;-----------------------------------------------------------------------------


; ------- Test #01 -------


Method      = PerfCounter
;--- Common properties ---
DestFolder  = Test Events
Title       = Test Event (Warning when between 5-70 for 3 recurrences)(Critical when less than 5)
Comment     = PerfCounter: \\IPREMOVED\PERFMON\Server_AvgIters_Counter
RelatedURL  = 
ScheduleMode= Regular
Schedule    = 
Interval    = 60
Alerts      = Server Average Iterations Critical 
ReverseAlert= No
UnknownIsBad= Yes
WarningIsBad= Yes
UseWarning  = Yes
WarningExpr = (("%SuggestedSimpleStatus%"=="UP") and ("%SuggestedReply%">"4") and ("%SuggestedReply%"<"70") and ("%SuggestedRecurrences%">"2") or ("%SimpleStatus%"=="Down") and ("%SuggestedReply%">"4") and ("%SuggestedReply%"<"70"))
UseCommonLog= No
PrivLogMode = Default
CommLogMode = Default
;--- Test specific properties ---
PerfCounter = \\IPREMOVED\PERFMON\Server_AvgIters_Counter
Condition   = LessThan
Value       = 5.00
DisplayMode = AsIs

;-----------------------------------------------------------------------------
; Exported 1 items

Sorry to bother you all the time like this but I just cant get my head around what is wrong with this/

KS-Soft Europe · Post by **KS-Soft Europe** » Tue Jul 31, 2007 7:14 am

I think, it does not work because of the bug with parenthesis. You have missed the parenthesis near the OR keyword. Could you try the following expression:

Code: Select all

(("%SuggestedSimpleStatus%"=="UP") and ("%SuggestedReply%">"4") and ("%SuggestedReply%"<"70") and ("%SuggestedRecurrences%">"2")) or (("%SimpleStatus%"=="Down") and ("%SuggestedReply%">"4") and ("%SuggestedReply%"<"70"))

Regards,
Max

Harroguk · Post by **Harroguk** » Tue Jul 31, 2007 7:26 am

Tested that.

It generated the same results as I was encountering prevoisly. I see what you mean about the missing parenthesis though.

Any more ideas?

KS-Soft Europe · Post by **KS-Soft Europe** » Tue Jul 31, 2007 8:12 am

Following expression works at our test environment as well:

Code: Select all

(("%SuggestedSimpleStatus%"=="UP") and ("%SuggestedReply%">"4") and ("%SuggestedReply%"<"70") and ("%SuggestedRecurrences%">"2")) or (("%SimpleStatus%"=="DOWN") and ("%SuggestedReply%">"4") and ("%SuggestedReply%"<"70"))

I just have converted DOWN to uppercase. Could you try that?

Regards,
Max

Harroguk · Post by **Harroguk** » Tue Jul 31, 2007 8:16 am

it seems that is the issue,

for anyone scrolling striaght to the end of the thread......

%SuggestedSimpleStatus% and %SimpleStatus% variables are CASE SENSITIVE