Network Management

In Alarm Notification I have set up a rule for all devices for the Link State UP (NMS Resource)  alarm.

 

There is a button to set alarm parameters that includes interface alias and also interface operation time (equivalent to alarm time) (S). Therefore I expect that email alerts will only be sent if the interface alias matches and deny sending email alerts for non-matching interfaces that go down, however it does not seem to work.

 

I also expect the interface operation time (alarm time) to send the email only after  the specified duration. However, when looking at the logs this value has been 1384355509 for 5mins 8 seconds and 1384355069  for 4min 48 seconds. Does anyone know what this value should be for 1 second?

That's not the parameter you're looking for. That time is in seconds since the epoch, and is the time the alarm was recorded at. It is recorded when the alarm is created, and it does not change afterwards.

It is used to that if traps are forwarded to other systems, it can be used to show the time the fault was detected, as opposed to the time the alarm was forwarded.

I think I know what you're trying to achieve - delayed email alerting - and there's no easy way within IMC to do it. You need to either forward the alerts to some other system that can handle delayed alerting (e.g. ScienceLogic, xMatters, PagerDuty), or you can write your own scripts to do it.

I wrote a script that does delayed email alerting by querying the DB, but it's a bit ugly. The better way is to query the eAPI, assuming you have the license.