Leveraging NMIS Dependancy in opEvents
To have the NMIS dependancy feature flow through the system, you will need to engage the NMIS escalation system which gives NMIS the opportunity for the dependancy analysis.
NMIS will continue to log events to the nmis event log but opEvents will be configured to use the JSON event directory.
For this to work as expected NMIS 8.6.8G should be used, or at least the notify::logJsonEvent should be backported from NMIS 8.6.8G.
If you are using opCharts, you can easily get automatic dependancies configured using the opCharts subnet tool described here opCharts Node Dependancy Management (Root Cause Analysis).
Configure NMIS Escalation Levels
Access the NMIS System configuration using the menu: "System → System Configuration → NMIS Configuration", select the "escalation" section, update the settings to be as below.
Alternatively, modify /usr/local/nmis8/conf/Config.nmis and change the escalation levels.
'escalation' => { 'escalate0' => '0', # now 'escalate1' => '60', # 1 minute 'escalate2' => '180', # 3 minutes 'escalate3' => '360', # 6 minutes 'escalate4' => '900', # 15 minutes 'escalate5' => '1800', # 30 minutes 'escalate6' => '3600', # 1 hour 'escalate7' => '7200', # 2 hours 'escalate8' => '10800', # 3 hours 'escalate9' => '21600', # 6 hours 'escalate10' => '43200' # 12 hours },
Configure NMIS with a JSON escalation at Level1
Configure NMIS to send JSON events at escalate1, you can do this through the GUI using the menu option "System → System Configuration → Escalation Policy", then edit the default entry and add "json:server" at Level 1 and click "Edit".
Configure opEvents to use JSON logs
Configure opEvents to use the JSON event directory instead of the NMIS event log.
/usr/local/omk/conf/opCommon.nmis
Comment or remove the nmis_eventlog section, add a section for nmis_json_dir
'opevents_logs' => { 'cisco_compatible' => [ '<nmis_logs>/cisco.log' ], #'nmis_eventlog' => [ # '<nmis_logs>/event.log' #], 'nmis_json_dir' => [ '<nmis_logs>/json', ], },
Restart the opEvents Daemon
service opeventsd restart
Now events will arrive in opEvents from the JSON folder, but these will have been delayed about 60 seconds and already had dependancy analysis done, and possibly flap events will reduce.