IDS Forum

Re: event trigger/alarm

Posted By: FRANK
Date: Wednesday, 21 December 2011, at 12:03 p.m.

In Response To: Re: event trigger/alarm (Fernando Nunes)

" Too Many Messages " is NOT a good strategy to decide which are useful
for customers.

For any nontrivial IDS event ( e.g., add a memory segment..), it should
be good to allow users to be able to do some thing s/he likes. You can
define that event severity level as very low( or normal), but it is a
event that attract attention on resources usage.....

So.....

Frank

On Tue, Dec 20, 2011 at 5:32 PM, Fernando Nunes <domusonline@gmail.com>wrote:

> Hmmm.... I checked the script. It depends on another one that was written
> by someone else (many years ago) and almost re-written by me over the
> years... But as of today I cannot supply this second one.
> This should be solved in a couple of days. If not, I could change this last
> script to avoid the dependence...
>
> Let me try to solve this weird situation... The purpose of this script as I
> tried to explain it to act on online.log messages after configuring this on
> a simple config script.
> The script I'm trying to obtain permission to distribute is a script that
> allows us to change the instance on a machine that has more than one (and
> that changes the INFORMIX variables accordingly). So, I think this and
> other scripts I have could benefit the community and I'm working on trying
> to make them available (most customers where I've been already have them
> somewhere).
>
> The config script looks like:
>
>
>
> #-----------------------------------------------------------------------------------------------------------------------------------
> # Field description:
> # 1-Online log
>
>
> msg|2-alarm_class_id|3-alarm_severity|4-alarm_class_msg|5-function|6-alarm_send|7-IDS
> versions
>
>
> #-----------------------------------------------------------------------------------------------------------------------------------
> #Checkpoint Completed|900|1|Checkpoint completed|ix_checkpoint|Y|:7:9:10:|
> Client host or user|901|3|Connect fail - User not trusted||Y|:7:9:10:|
> password is not correct for the database server|901|3|Connect fail - Bad
> password||Y|:7:9:10:|
> Archive started|902|2|Archive Started||Y|7:9:10:|
> Dynamic Server Started|903|3|Engine started||Y|:7:9:10:|
> Dynamic Server Stopped|903|3|Engine stopped||Y|:7:9:10:|
> Quiescent Mode|903|3|Engine entered Quiescent Mode||Y|:7:9:10:|
> On-Line Mode|903|3|Engine entered On-Line Mode||Y|:7:9:10:|
> KAIO: out of OS resources|904|4|Kaio out of OS resources||Y|:7:9:10:|
>
> #-----------------------------------------------------------------------
>
> So, for example, when a "KAIO*" message appears I call the alarm program
> with class_id = 904 (which I customized in the script), severity 4,
> class_msg = "Kaio out of OS resources", and it works for versions 7, 9, 10
> (11: should be added). Optionally it could call a funcion specified in the
> 5th column and defined in another shell script that's loaded by the main
> one (so that you can run very specific commands for each particular
> situation if needed)
>
> So, this is completely configurable and allows you to easily trap whatever
> our R&D did not decide to call the alarm program for.
>
> Another (simpler?) option would be to set ALRM_ALL_EVENTS in ONCONFIG, but
> my experience with that was not very good (but it was long ago, and I can't
> exactly remember the problems - if any - besides the obvious one: two many
> messages)
>
> Regards.
>
> On Tue, Dec 20, 2011 at 6:36 PM, FRANK <yunyaoqu@gmail.com> wrote:
>
> > Fernando,
> >
> > Thanks a lot! it is great if you can send me your script. I am not
> > rushing, any time is good.
> >
> > Thanks again,
> > Frank
> >
> > On Tue, Dec 20, 2011 at 12:01 PM, Fernando Nunes <domusonline@gmail.com
> > >wrote:
> >
> > > I'm not sure if the changes in the alarms made recently have changed
> > this.
> > > In the past I have created a shell script that constantly monitors
> (with
> > a
> > > tail -f, not pooling) the online.log and can be configured to act on
> > > specified messages (regular expressions if I remember well).
> > >
> > > This script can be configured to call alarmprogram, which I normally
> > > costumize so that it recognizes more (customized) events.
> > > The advantage of doing that is that the configuration made once for the
> > > alarms (SMS, email, syslog etc.) will work for all events.
> > >
> > > I can provide the script if you don't find a better solution. How fast
> > > would you need this?
> > >
> > > (Eric: If you're reading this, we must talk! :) )
> > > Regards
> > >
> > > On Tue, Dec 20, 2011 at 4:47 PM, FRANK <yunyaoqu@gmail.com> wrote:
> > >
> > > > Hi, Folks,
> > > >
> > > > IDS11.50 FC8, Redhat Linux.
> > > >
> > > > I am going to narrow down which job peoridically caused IDS to add
> new
> > > > memory segments.
> > > >
> > > > Basically, the plan is, whenever IDS is adding a new memory segment(
> > > > as in the attached online log messge) , the event will trigger my
> > > > script to take a snapshot of all current jobs running in IDS.
> > > >
> > > > My question is how to determine this event in the alarm script? Any
> > > > other good choices?( like a sensor.....)
> > > >
> > > > Thanks,
> > > > Frank
> > > >
> > > > 03:10:23 Maximum server connections 299
> > > > 03:10:23 Checkpoint Statistics - Avg. Txn Block Time 0.001, # Txns
> > > blocked
> > > > 9, Plog used 8827, Llog used 102989
> > > > 03:12:02 Dynamically allocated new virtual shared memory segment
> (size
> > > > 32768KB)
> > > > 03:12:02 Memory sizes:resident:3327048 KB, virtual:3313540 KB, no
> > > SHMTOTAL
> > > > limit
> > > > 03:15:23 Logical Log 17698 Complete, timestamp: 0x584eb4c3.
> > > >
> > > > --0015174ff3d497118004b488d3c9
> > > >
> > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
> *******************************************************************************
> > > > Forum Note: Use "Reply" to post a response in the discussion forum.
> > > >
> > > >
> > >
> > > --
> > > Fernando Nunes
> > > Portugal
> > >
> > > http://informix-technology.blogspot.com
> > > My email works... but I don't check it frequently...
> > >
> > > --00248c7691360936ac04b4890374
> > >
> > >
> > >
> > >
> >
> >
>
> *******************************************************************************
> > > Forum Note: Use "Reply" to post a response in the discussion forum.
> > >
> > >
> >
> > --001636eeffdb59739804b48a593b
> >
> >
> >
> >
>
> *******************************************************************************
> > Forum Note: Use "Reply" to post a response in the discussion forum.
> >
> >
>
> --
> Fernando Nunes
> Portugal
>
> http://informix-technology.blogspot.com
> My email works... but I don't check it frequently...
>
> --00248c7691362e8ac404b48da4f7
>
>
>
> *******************************************************************************
> Forum Note: Use "Reply" to post a response in the discussion forum.
>
>

--0015174ff3d4930bb304b49d29d0

Messages In This Thread

• event trigger/alarm
  FRANK -- Tuesday, 20 December 2011, at 11:47 a.m.
  • Re: event trigger/alarm
    Fernando Nunes -- Tuesday, 20 December 2011, at 12:01 p.m.
    • Re: event trigger/alarm
      FRANK -- Tuesday, 20 December 2011, at 1:36 p.m.
      • Re: event trigger/alarm
        Fernando Nunes -- Tuesday, 20 December 2011, at 5:32 p.m.
        • Re: event trigger/alarm
          FRANK -- Wednesday, 21 December 2011, at 12:03 p.m.
      • Re: event trigger/alarm
        Fernando Nunes -- Wednesday, 21 December 2011, at 8:51 p.m.
  • Re: event trigger/alarm
    rroussey@comcast.net -- Tuesday, 20 December 2011, at 1:19 p.m.
    • Re: event trigger/alarm
      FRANK -- Tuesday, 20 December 2011, at 1:38 p.m.
  • Re: event trigger/alarm
    Khaled Bentebal -- Tuesday, 20 December 2011, at 4:18 p.m.
    • Re: event trigger/alarm
      FRANK -- Wednesday, 21 December 2011, at 12:04 p.m.
  • Re: event trigger/alarm
    MARK JALKIEWICZ -- Wednesday, 21 December 2011, at 10:02 a.m.
    • Re: event trigger/alarm
      FRANK -- Wednesday, 21 December 2011, at 12:06 p.m.

IDS Forum is maintained by Administrator with WebBBS 5.12.