Escalation Policy
You can add, edit and delete entries to the NMIS Escalation Policy table. This controls when current events in the Current Events Table are escalated by NMIS. Only un-acknowledged events are escalated here. Events are matched to Escalation Policy through keyword matching on Group, Role, Type, Event fields. Further granularity is possible by regex matching on Event_Node and Event_Details fields.
The first 4 fields are the table key, and taken together, must represent a unique string. These are used to match on a particular event in the Current Events table.
The next two fields, Event_Node and Event_Details, are regex type entries ( perl regular expressions without the terminators // ), and used to match on an event Node and Details fields - see Current Events.
A list of Device Groups. Prefilled selection from nmis.conf 'Grouplist'. See Nodes Table.
A list of pre-configured Device Roles. See Nodes Table.
Select one of "default", "core", "distribution", "access"
A list of pre-configured Device Types. See Nodes Table.
Select one of "default", "router", "switch", "server", "generic"
A list of pre-configured Events. See Event Policy Table.
Select one of "default", "Generic Down", "Generic Up", "Interface Down", "Interface Up", "Node Down", "Node Reset", "Node Failover", "Node Up", "Proactive Response Time Threshold", "Proactive Reachability Threshold", "Proactive CPU Threshold", "Proactive Memory Threshold", "Proactive Interface Availability Threshold", "Proactive Interface Input Utilisation", "Proactive Interface Output Utilisation", "Proactive Availability Threshold Interface", "Proactive Interface Input NonUnicast", "Proactive Interface Output NonUnicast", "RPS Fail", "SNMP Down", "SNMP Up"
A regex. Default entry is '.' - match all. Matches the nodename in the Current Events table.
Some examples: ^au - match all nodes starting with 'au' ^au|^nz - match all nodes starting with 'au' and 'nz' ^[^b]|^be|^bh - match all nodes that dont start with 'b', as well as 'be' and 'bh'
A regex. Default entry is '.' - match all. Matches the event detail field in the Current Events table.
Escalation at 5min Level0. Escalation time may be set in nmis.conf. If immediate notification is required, set Level0=0 time in nmis.conf. Level0 escalation supercedes 'mail=true' in Event Policy.
A keyword string that identifies a notification procedure, followed by one or more notification details.
Entries may be comma seperated - see examples.
Valid notification types as of V3.2.x are
Netsend
netsend:WKS1 netsend:WKS1:WKS2
Send a Windows type popup message to a windows workstation, or list of workstations. For Linux, requires 'smbclient' to be installed on the NMIS server.
email:contact1 email:syscontact email:contact1:contact2 email:contact1:contact2:contact3
Send a notification email to the list of email addresses referenced by 'contact' in the Contacts table.
If the special keyword 'syscontact' is used, use the name gathered from the device 'sysContact' SNMP entry, as a reference into the Contacts table.
The email has the following format. subject => node event - details at time body => Node Notification at LevelX Event Elapsed Time: xxyy Severity: x Event: event Details: event details http:// url link back to Current Events table.
Pager
pager:contact1 pager:syscontact pager:contact1:contact2 pager:contact1:contact2:contact3
Send a numeric page using SNPP to the pager number contained in the field 'pager' in table Contacts.
If the special keyword 'syscontact' is used, use the name gathered from the device 'sysContact' SNMP entry, as a reference into the Contacts table.
CCopy
ccopy:contact1 ccopy:syscontact ccopy:contact1:contact2 ccopy:contact1:contact2:contact3
Send a notification carbon copy mail to the list of email addresses referenced by 'contact' in the Contacts table.
If the special keyword 'syscontact' is used, use the name gathered from the device 'sysContact' SNMP entry, as a reference into the Contacts table.
subject => COPY of Notification node event - details at time body => FOR INFORMATION ONLY - THIS SHOULD BE DEALT WITH BY THE PRIMARY GROUP THAT IS CURRENTLY WORKING Copy of Notification at LevelX Event Elapsed Time: xxyy Severity: x Event: event Details: event details http:// url link back to Current Events table.
Multiple notification procedure types may be comma seperated like this
netsend:wks1,email:contact1:contact5,ccopy:contact4,pager:helpme
Additional Escalation Levels.
15 mins
30 mins
40 mins
50 mins
1 hr
2 hrs
3 hrs
6 hrs
12 hrs
1 day
Set to 'false|true'. If set true, an UP event notification will be sent to the list of Contacts who received a 'down' event notification. This Policy entry key is stored in the Current Events table, for this event, so that when the current event is cleared, this policy entry list of notification procedures is parsed again up to the current escalation level, and all contacts notified, from Level0 to LevelX.
This is subject to DutyTime rosters, so that only contacts who have a current DutyTime will receive the up notification.
Group Role Type Event Event_Node Event_Details Level0 Level1 Level2 Level3 Level4 Level5 Level6 Level7 Level8 Level9 Level10 UpNotify Add default default default Node Down ^la . email:Helpme:LAX email:Contact1:Contact2 default default default Node Down ^bo . email:Helpme:BOR email:Contact1:Contact2 default default default Node Down ^cn . email:Helpme:CNR email:Contact1:Contact2 default default default Node Down ^cn . email:Helpme:SHG email:Contact1:Contact2 default default default Node Down ^hk . email:Helpme:HKG email:Contact1:Contact2 default default default Node Down ^us . email:Helpme,ccopy:US email:Contact1:Contact2 default default default Node Down ^ds . email:Helpme email:Contact1:Contact2 default default default Node Down ^tp . email:Helpme,ccopy:MGR email:Contact1:Contact2 default default default Node Down device10 . email:ADMIN:Contact1:Contact2 default default default Node Down device14 . email:ADMIN:Contact1:Contact2 default default router Interface Down . . GROUP1_mail GROUP1 default default Node Down ^[^b]|^be|^bh . netsend:WKS03:WKS04:WKS01 email:Contact1:Contact2 GROUP1 default default Node Down device3 . netsend:WKS03:WKS04:WKS01 email:Contact1:Contact2 GROUP1 distribution router Node Down device4 . netsend:WKS01:WKS04:WKS03