Problem: We have a lot of systems that mount the /same file system. We let it be discovered by typical filesystem LLD and have space triggers for all file systems that also get applied to these. Of course, when one of these gets below the threshold, it causes an alert for all systems that share the mount.
I would like to use global event correlation to close all but the first event, but only within host groups. For example, some /same file systems are in a PROD group, some are in TEST, I want one problem to be open for each host group and would not want a problem in a problem first found in TEST to cause a PROD problem to be closed.
I think I can add a tag (Say FSNAME) in the trigger with the macro {#FSNAME} and the tag will have the value /same.
There is a EC condition for "New event host group", but why isn't there a condition for "Old event host group"? I would want them to match.
Any ideas?
Thanks
I would like to use global event correlation to close all but the first event, but only within host groups. For example, some /same file systems are in a PROD group, some are in TEST, I want one problem to be open for each host group and would not want a problem in a problem first found in TEST to cause a PROD problem to be closed.
I think I can add a tag (Say FSNAME) in the trigger with the macro {#FSNAME} and the tag will have the value /same.
There is a EC condition for "New event host group", but why isn't there a condition for "Old event host group"? I would want them to match.
Any ideas?
Thanks