DCE HTTP POST Creating Multiple Alerts

[DCIM_Support]

I have a HTTP POST action setup on a DCE threshold which generates an alert everytime the threshold is breached.  The problem is that if the threshold has not been cleared by the next poll cycle in DCE another alert is generated.

I have set the alarm action to not repeat

However if the threshold is say breached for 15 minutes and the poll cycle is set to 5 minutes I will get 3 alerts raised at the destination end.  Is there a way to stop this?

(CID:111939029)

[DCIM_Support]

Hi James,

It's not a known issue that I'm aware of. Is this action tied to any other thresholds and if so, does it repeat for that threshold as well?

Do you have any other alert actions that you can test? Do they have the same issue? Can you test this threshold as well as another?

What version of DCE are you running?

What is the device / sensor / threshold that you have configured?

Can you delete this action totally and recreate it to make sure there isn't some corruption in the alert itself, maybe the repeat check box was checked initially and un-checking it had no effect in the background. 

Steve

(CID:111939277)

[DCIM_Support]

Steven Marchetti -

I seem to of misinterpreted the fault.  You are correct that the HTTP Post setup doesn’t created multiple alarms for each poll cycle it does however created another alert when the threshold has been cleared.  This means if a threshold is breached and cleared multiple times there is an two alerts created each time.  Did you see this from your setup as well?

(CID:112626165)

[DCIM_Support]

Hi James,

Again, I don't have anything to receive the HTTP post so I simply ran a packet capture where I saw 5 attempts for every alert. Assuming it was always 5 to 1, I saw a single event and a single clearing event. Yes, if the threshold is breached and cleared 10 times, I would expect to see 20 posts. 

If the threshold is created on DCE, there's little you can do other than potentially disabling the clearing event. 

Steve

(CID:112626197)

[DCIM_Support]

Steven Marchetti How do you disable the clearing event in DCE?

(CID:113641744)

[DCIM_Support]

Hi James, It's on the alarm action under advanced:

Steve

(CID:113641755)

[DCIM_Support]

Steven Marchetti This only seems available on the email alarm

(CID:113642045)

[DCIM_Support]

My Apologies. I guess what you can do then is to uncheck informational under severities. I believe the clearing event would be at that level. 

(CID:113642280)

[DCIM_Support]

Hi James,

I don't have a recipient app for an http alert so I tested e-mails as well.

I set up a 1 minute scan time and a max temp threshold and I got 1 e-mail in 10 minutes. 

I did the same for a value over time of 1 minute and in the 10 minutes it was in alarm, I too only got the breach and return to normal.

I'll try setting up an http alert for these same thresholds and I will run a packet capture to see if something is being sent that way. I'll let you know what I see.

Steve

(CID:111939293)

[DCIM_Support]

Steven Marchetti - This is over 5 different DCE's version 7.4.1, the thresholds are two different types, maximum value (current) and above value for time (temperature).  I will run more tests but at the moment it looks like it covers all thresholds on all DCE's.

There are some email alerts but they work fine in that one email for breach and another for return to normal.

(CID:113642120)

[DCIM_Support]

Hi James,

On the same device, I created an HTTP post alert. I used this on the value for time threshold. I started a packet capture and set the threshold below the actual value to cause it to alert. After 60 seconds, it alerted. I waited 20 minutes and then reset the threshold to be above the current threshold, causing the alert to clear. I stopped the packet capture and looked at the target IP. I can see where the post failed 5 times @ 1:13 PM. This was an apparent retry. I also see where there were 5 failed posts @ 1:33 where the threshold had cleared. There should have been 5 every minute if it were following the poll time or the "after time" part of the threshold as I had that set to 60 seconds. I would maybe expect at least 5 failures every 5 minutes if there was something specific to the 5 minute repeat you're seeing. 

I am not saying there's not something wrong, simply that I can not reproduce it. Have you had any luck deleting and recreating the alert action?

Steve

(CID:111939317)

[DCIM_Support]

Steven Marchetti I will run the test stated above  over the next few days and see what happens.  Will also try to delete and recreate the HTTP Post

(CID:112625660)

[DCIM_Support]

This question is closed for comments. You're welcome to start a new topic if you have further comments on this issue.