HP StorageWorks 9100 Extreme Data Storage System administration guide V1.0.2 (AN540-96018, February 2010)

8 Verifying and maintaining the system
Managing e-mail alerts
Alert filter overview
An alert filter comprises the following:
• Name—This is a convenient name used to identify the filter when modifying or deleting it.
• Enabled status—An alert filter can be disabled. This means that although the filter remains in the
system, it will not cause e-mails to be sent even when it matches a log message
• Filter—This is an expression which allows syslog-ng to scan log messages and decide if an
alert (e-mail) should be sent. See syslog-ng(8) documentation for how to construct filters.
• Recipient—This is a list of e-mail addresses where an alert should be sent. If this is omitted, e-mail
is sent to the Default Alert e-mail address. This default is specified when you first installed the system
or can be changed using the exdsmgr reconfigure system command. Using a default
makes it convenient to change the recipient of all alerts at once. Alternatively, you can send different
alerts to different destinations by specifying specific e-mail addresses on specific alert filters.
• Throttle—If many messages arrive at once, many e-mails could be sent. You can prevent this by
specifying a throttle period (measured in seconds). If two identical log messages are found, an e-
mail alert is sent for the first message. However, an e-mail alert is only sent for the second message
if the throttle setting is reached since the first message was sent. A throttle=0 sets throttling to
the default value of one minute.
NOTE:
For a throttle to work, the messages must be identical in all respects (except for the timestamp).
E-mail alerts best practices
HP recommends that you monitor the e-mail alerts generated by the HP ExDS9100 system. The
information contained in the alerts is often critical to the health of the system.
To receive alerts, use the exdsmgr reconfigure system command and specify an e-mail address
or addresses to receive the e-mail alerts. See Changing network and system parameters for more
details.
The HP ExDS9100 system throttles e-mail alerts. That is, when an email is sent, subsequent events that
match the same filter will not trigger an e-mail unless the throttle period has expired. This means that
when you receive an e-mail alert, you should be aware that the e-mail might only represent an example
of the events occurring on the system. In general, when you get an e-mail alert, you should log in to
the system and run the exdsmgr syscheck command. This will tell you whether the e-mail contains
the only event of concern or whether there are many other events also happening.
9100 Extreme Data Storage System administration guide 81