LMS 3.1 Automated actions trouble

[agivens02]

I have LMS 3.1 with all updates. I have setup RME>Tools>Syslog>Automated actions to email specific alerts. This was working fine for several weeks until about 5 days ago LMS stopped sending email alerts. Has anyone encountered problems with the automated actions. All appeared well and then it stopped working for no apparent reason. Thank you for any assistance you can provide.

[Joe Clarke]

Please post a screenshot showing the configuration of the config change AA. Also, do these messages make it into the RME database? That is, can you run a syslog report, and see the messages that were generated today?

[agivens02]

These messages do not appear to be making it into the RME database. As you requested I ran a 24 hour report and came up with nothing. However as I stated before they are making it to the syslog file. I have attached the AA screen shots and also screen shots of the 24 hour report which comes up blank. Any ideas why this is happening?

[Joe Clarke]

Please post the NMSROOT/MDC/tomcat/webapps/rme/WEB-INF/classes/com/cisco/nm/rmeng/csc/data/filters.dat file.

[agivens02]

Ok, please see attached.

[Joe Clarke · Accepted solution]

This is your problem. Your filter mode is set to KEEP, but you do not have filters defined for the interesting message types. Right now, the only messages that will be added to the database, or trigger AAs will be:

PIX-6-302002

PIX-6-302001

PIX-6-304001

FW-6-SESS_AUDIT_TRAIL

LINEPROTO-5-UPDOWN from 10.21.4.253

*-7-*

LINK-3-UPDOWN from 206.77.151.254

LINEPROTO-5-UPDOWN from 206.77.151.254

LINK-5-CHANGED from 206.77.151.254

LINK-5-UPDOWN from 206.77.151.254

If you want other messages, you will either need to change your mode to DROP, or define new filters to match those messages.

[agivens02]

I deleted all AA that I had and also any filters associated with these actions. I used one of our 6500's as a test. I used the config change Mnemonic under SYS CONFIG_I and created a filter mirroring this AA and it worked. This makes me very happy and I appreciate your persistence in helping me. I am still unsure why I have to setup a filter when I have already created an AA that is very specific in what I want reported. Is the filter actually necessary? It appears to be because when I run a test without the filter it does not work. In other words LMS will not send me an alert via email when the filter is not in place.

[Joe Clarke]

No, the filter is not necessary. As I said, if you change the filter mode to DROP under RME > Tools > Syslog > Message Filters, then you only need to created filters for messages you do NOT want to keep. In that case, the majority of the messages can be processed.

[agivens02]

Ok I got it. Thanks for all your help. Greatly appreciated.