Total Alarms counter (acknowledged, cleared, current, historical) and Purge (4295903)

How to get a count of the total number of Alarms stored in my Foglight database (acknowledged, cleared, current, historical, etc)

Also how to get alarms counter break down by source type(Rule Name)

How to Purge alarms?

Investigate High Alarms Counter

Total alarms counter

The following script can be run from the Script Console to get the total number of alarms in the environment.

Note that it may take some time to complete depending on the alarm count.

import groovy.sql.Sql;
import com.quest.nitro.service.util.JDBCHelper;
msg = new StringBuilder();
try{
sql = new Sql(JDBCHelper.getDataSource());
msg.append("Alarms Table Count: \n");
msg.append(sql.rows("select count(*) from alarm_alarm"));
}catch (Exception ex){
msg.append("Exception"+ex);
}
return msg.toString();

Please review section "Alarms counter break down by source type (Rule Name)" for a script that returns the alarms break down by rule.

If the count is greater than 5,000 alarms you should consider:

• Are the root causes of the alarms for repetitive issues being addressed?
• There is a very large number of alarms - could this be affecting performance of the dashboards that query alarms?

Alarms counter break down by source type (Rule Name)

Run the following script from Script Console in order to see the alarm break down by rule name:

import groovy.sql.Sql;
import com.quest.nitro.service.util.JDBCHelper;
msg = new StringBuilder();
sql = new Sql(JDBCHelper.getDataSource());
msg.append(sql.rows("select source_name, count(*) as ruleCount from alarm_alarm group by source_name order by ruleCount DESC"));
return msg.toString();

Note: Above break down can also be seen from  (Administration > Alarms> Alarms Analysis dashboard but may not show all the alarms if too many in the system.
It is possible to run Alarms Analysis Report to be updated on the regular basis regarding alarms behavior.

How to Purge Alarms and Investigate High Alarms counter

• By default cleared alarms are purged after 30 days, but some alarms may not be cleared automatically, for scripts to clear alarms refer to the following solutions:
  • Clear Alarms older then X days (4289458)
  • Is there is a way to clear alarms specific to only certain rules? (4293940)
• To change the alarm purge time, please do the following:
  1. Go the Administration > Rules & Notifications > Manage Registry Variable
  2. Search for the variable named "AlarmPurgeAge"
  3. Change the value to a lower number.
• For more information on purging alarms refer to the following solutions:
  • How to Purge Alarms? How to schedule purging of Alarms? (4289502)
  • Detailed information on clearing and purging alarms (4309807)
  • Is there a purge alarm script that deletes old cleared alarms but leaves current alarms? (4273103)

Important Note: Clearing an alarm, clears the alarm from the current Alarm dashboard, but purging is what actually deletes the alarm from the Foglight Database repository.

Regarding orphan alarms

Refer to: The graph "All System Alarms + Changes" displays more alarms than the alarm table KB 4258296.

From a Management Server Support Bundle, on the DiagnosticSnapshot file you can search for alarm_alarm to also get the alarm counter, this is one example:

+--------------------------------+----------------+---------------+---------------+
| Table Name                     | Number of Rows | Data Length   | Index Length  |
+--------------------------------+----------------+---------------+---------------+
| alarm_alarm                    | 108,753        | 283,287,552   | 74,334,208    |

In the same file, to view current alarms search for Current alarm totals; for example:

==================== Alarm Service =========================
Current alarm totals: 
Warning: 3680
Critical: 3788
Fatal: 42926