VMWare snapshot quiesceing causing alarms

[Chad Rempp]

Chad Rempp [http://community.zenoss.org/people/crempp] created the discussion

"VMWare snapshot quiesceing causing alarms"

To view the discussion, visit: http://community.zenoss.org/message/70791#70791

--------------------------------------------------------------
I've been having a problem that I can't figure out how to solve.

We use Veeam for nightly snapshot backups of our infrastructure. During the snapshot some VMs momentarily stop responding. This is a fairly well known side effect of VMWare snapshots and from my research you can not completely prevent this - only mitigate it.

When a VM stops responding due to snapshotting for a longer than normal period Zenoss generates an alert.

I don't want to do to much to the alerting rules because I don't want to prevent real events from making it through but I aslo want to stop all the false alarms (about 2 to 10 per night).

Ideally I would like to have events during evening hours have a 5 to 10 minute delay but it doesn't look like that is possible.

Does anyone have any ideas on how I can stop these false alarm? They are causing the sysadmins to ignore Zenoss completely :(

Thanks,

Chad
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/70791#70791]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[jmp242]

jmp242 [http://community.zenoss.org/people/jmp242] created the discussion

"Re: VMWare snapshot quiesceing causing alarms"

To view the discussion, visit: http://community.zenoss.org/message/70813#70813

--------------------------------------------------------------
Hmmm, what version of Zenoss? You can use delays in the alterting rules in <= 3.2.1 to wait before sending an alert based on an event, and I think you can do the same, plus with notification schedules have even more flexibility with >4.2.0 ...

--
James Pulver
ZCA Member
LEPP Computer Group
Cornell University
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/70813#70813]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Chad Rempp]

Chad Rempp [http://community.zenoss.org/people/crempp] created the discussion

"Re: VMWare snapshot quiesceing causing alarms"

To view the discussion, visit: http://community.zenoss.org/message/70814#70814

--------------------------------------------------------------
I'm using Zenoss 3.2.1.

Thanks, I've tried using delays but I would prefer not to have the delays during the daytime hours when people are in and our server issues need quicker responses.

I've been looking for a way to combing delays and schedules but had read on these forums that it wasn't possible with the version 3. Thanks for letting me know it's supported in version 4.2.

Is there any way other than upgrading Zenoss for the more flexible scheduling? If not I'll have to consider upgrading sooner rather than later.
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/70814#70814]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[jmp242]

jmp242 [http://community.zenoss.org/people/jmp242] created the discussion

"Re: VMWare snapshot quiesceing causing alarms"

To view the discussion, visit: http://community.zenoss.org/message/70815#70815

--------------------------------------------------------------
Well, what you could do is have two alerting  rules, one with delays and one with none, and have the none be the default, and have a subclass or something that filters to delay - then use an event transform to check the time and move it to the delay event class I think.

--
James Pulver
ZCA Member
LEPP Computer Group
Cornell University
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/70815#70815]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]

[Chad Rempp]

Chad Rempp [http://community.zenoss.org/people/crempp] created the discussion

"Re: VMWare snapshot quiesceing causing alarms"

To view the discussion, visit: http://community.zenoss.org/message/71494#71494

--------------------------------------------------------------
Sorry, left this thread for a while.

jmp242, I'd never created an event transform before so I took an evening to figure it out. I think I have the basics down.

What I did may not be correct but I'm going to watch it closely for a day or two. I create a mapping with the following transform

from datetime import datetime
t = datetime.fromtimestamp(evt.firstTime)
duration = evt.lastTime - evt.firstTime
if ( (t.hour < 6 or t.hour >= 19) and ( duration < 1800) ):
   evt._action = "drop"


I may need to do something other than drop the event though.
--------------------------------------------------------------

Reply to this message by replying to this email -or- go to the discussion on Zenoss Community
[http://community.zenoss.org/message/71494#71494]

Start a new discussion in zenoss-users by email
[discussions-community-forums-zenoss--***@community.zenoss.org] -or- at Zenoss Community
[http://community.zenoss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2003]