Powershell script to forward alarms

[Shestakov]

You are right, we've added 7th variable with the unique alarm ID. It should work for scripts.
Could you specify how you tried to get the value?

[sandsturm]

Sorry, I had a fault in my script. I'm now able to pass this ID to a script. But now I see that the ID is always the same for the same alert, doesn't matter if the alert was thrown from different sources. I'll explain that with an example. I use the alert "Backup Job disabled" for my tests, because I can force this alert easily (I sat the "Time in disabled state to 3 Minutes"). The script just outputs the parameter values into a file. The script looks as following:

Code: Select all

set Alarm=%1
set Node=%2
set Summary=%3
set time=%4
set status=%5
set oldstatus=%6
set id=%7

echo Alarmname: %Alarm% >> C:\admin\scripts\ONEalarm.log
echo Node: %Node% >> C:\admin\scripts\ONEalarm.log
echo Summary: %Summary% >> C:\admin\scripts\ONEalarm.log
echo Date: %time% >> C:\admin\scripts\ONEalarm.log
echo Status: %status% >> C:\admin\scripts\ONEalarm.log
echo OldStatus: %oldstatus% >> C:\admin\scripts\ONEalarm.log
echo ID: %id% >> C:\admin\scripts\ONEalarm.log
echo -------------- >>C:\admin\scripts\ONEalarm.log

The output looks as following:

Alarmname: "Backup job disabled"
Node: "<VeeamServername>"
Summary: "Job '<Job_1>' is in the disabled state for more than defined in the threshold (3 minutes). "
Date: "03.04.2019 08:16:04"
Status: "Warning"
OldStatus: "Reset/resolved"
ID: "1061"
--------------
Alarmname: "Backup job disabled"
Node: "<VeeamServername>"
Summary: "Job '<Job_2>' is in the disabled state for more than defined in the threshold (3 minutes). "
Date: "03.04.2019 08:34:16"
Status: "Warning"
OldStatus: "Reset/resolved"
ID: "1061"
--------------
Alarmname: "Backup job disabled"
Node: "<VeeamServername>"
Summary: "<Job_2> are back to normal "
Date: "03.04.2019 08:35:01"
Status: "Reset/resolved"
OldStatus: "Warning"
ID: "1061"
--------------

It looks, that the ID is relevant for the Alarm ifself, but not unique for an alarm which is sent from a specific source (Job_1 or Job_2)... but that doesn't help me, because if I get the Reset/resolved alarm, I want to map this Reset/Resolved to the correct Alarm from before, that I know which alarms are solved and which are not. Do you understand my idea?

thx,
sandsturm

[Shestakov]

I understand the idea, but "Backup job disabled" may be not the best alarm to check the behavior as object is "Backup Server", not "backup job".
Try to check the behavior with "Backup repository free space" alarm by changing the threshold(will work if you have more than 1 repository).
Thanks!

[sandsturm]

Looks better now, I have now a unique ID per repository/alert combination. So far so good....

Another question:
Is it possible to pass the alerts to a powershell script instead of a cmd or bat file?
I tried it, but if I use a powershell, then every space is used as a delimiter, for example:
I tried to use the command:

Code: Select all

powershell.exe "C:\admin\scripts\Veeam_alarm.ps1" %1 %2 %3 %4 %5 %6 %7

If the alarmname is "Backup repository free space", I have the first word "Backup" in %1, the second word "repository" in %2 and so on, if I do this with a cmd or bat, i have the complete string in %1.
I tried to use:

Code: Select all

powershell.exe "C:\admin\scripts\Veeam_alarm.ps1" -alertname %1 -node %2 ... 

but that did not work either. Is there a way to use a powershell script to process the alerts?

thx,
sandsturm

[Shestakov]

Try to use quotation marks:

Code: Select all

Powershell.exe “file name” ‘%1’

[sandsturm]

Hi Shestakov

It works now with the quotation marks well. I'm struggling with the next problem. If I type in such an action directly into the value field of the alarm setting in this format:

Code: Select all

powershell.exe C:\admin\scripts\Veeam_alarm.ps1 '%1' '%2' '%3' '%4' '%5' '%6' '%7'

it works fine. But now I want to configure this notification action for all my alarms, i found the link https://www.veeam.com/kb1547 to set my action for all alarms. If I try the following:

Code: Select all

Update Alarm Set actions = '<Actions><SendMail Value="admin@company.net"/><RunScript Value="powershell.exe C:\admin\scripts\Veeam_alarm.ps1"/></Actions>'

it works fine, but if I try to add the parameters %1 %2... as following:

Code: Select all

update monitor.Alarm 
set actions = '<Actions><RunScript Value="powershell.exe C:\admin\scripts\Veeam_alarm.ps1 ''%1'' ''%2'' ''%3'' ''%4'' ''%5'' ''%6'' ''%7''"/><SendMail Value="admin@company.net"/></Actions>'

and I check the values afterwards in Veeam monitor, all alarms are updated, but only with the following string:
powershell.exe C:\admin\scripts\Veeam_alarm.ps1

the parameters %1 %2... are not sat yet. We tried above command with different quotation marks as " or ' or as &quot; but we were unsuccessful. Do you have an idea?

thx,
sandsturm

[Shestakov]

What product version are you at? In update 4 we added new tab for alarms called "Actions". Do you run scripts under the "Actions" tab or "Notifications" one?

[sandsturm]

I have installed update 4 and I tried to run the script in the Notifications tab. Should I use the Actions tab instead? The above command with the "update alarm set" affects the Notifications tab and not the Actions tab, therefore I tried to do it there...

thx,
sandsturm

[Shestakov]

This script works fine in my lab:

Code: Select all

update monitor.Alarm 
set actions = '<Actions><RunScript Value="powershell.exe C:\admin\scripts\Veeam_alarm.ps1 ''%1'' ''%2'' ''%3'' ''%4'' ''%5'' ''%6'' ''%7''"/><SendMail Value="admin@company.net"/></Actions>'

You can just copy actions of one alarm to the others

Code: Select all

 update [monitor].[Alarm]
  set [actions] = a.[actions]
  from (select * from [monitor].[Alarm]) a
  where a.[alarm_id] = ?

Where ? is an alarm_id of the alarm with correct "actions" field.

[ctalbot]

I'm having an issue passing parameters to a batch script. Using the example code above by sandstrum it appears only the timestamp parameter is coming through. All other parameters are blank. This is on a W2K16 server with Veeam One 9.5U4. I've tried it in the notification and actions tab with the same result. Anyone else experiencing this?

Code: Select all

C:\scripts>type ONEalarm.log
Alarmname:
Summary:
Node:
Summary:
Date: 11:13:43.39
OldStatus:
ID:
--------------

[ctalbot]

You can disregard. I got this to work by using the example powershell syntax above within the notification tab:

Code: Select all

powershell.exe C:\scripts\pass_args.ps1 '%1' '%2' '%3' '%4' '%5' '%6' '%7'

[sandsturm]

I have to come back to this topic with VeeamONE event IDs. It's great that these Event ID's are now possible in Veeam one, but I have the following issue with it:

We send events thrown by Veeam ONE to our ServiceManagement system and therefore we have to rely on the eventID which is created from Veeam ONE. We have different Backupjobs for Backup with Veeam agents (Windows and Linux). Unfortunately, there is only one Event ID thrown for different (Agent)-Backup jobs by VeeamONE. This leads to the fact, that we just see one event in our service managment system, although multiple backup jobs failed. Do you think it's possible to change that behavior that every backup job has its own VeeamONE event ID?

thx
sandsturm

[Vitaliy S.]

Right now it is not possible, but let me run this by our dev team and I will log a CR for our next updates.

[sandsturm]

thanks a lot, that would help.
By the way: I'm not sure if this is only for Agent Backupjobs, or if this "problem" also occures for "standard" Backup jobs...

[Vitaliy S.]

We will check this out too, but most likely the ID is assigned to the job type/alarm and is kept the same.

[sandsturm]

Hi Vitaly, the problem is the same for "standard" VM backup jobs. Events from different backup jobs on the same VBR server do have the same alarm ID. I see the same Event ID also for different days. Example: Job 001 failed on monday evening, event ID 1000 is used. Job 002 failed on tuesday evening, event ID 1000 is used here as well. This is a big problem for us, because if 5 backupjobs are failing one evening, they all have the same event ID. I just see one event in our Event-Management system in this case.

is there a chance that this behavior will be changed? Or shall I open a Veeam case for that?

thx
sandsturm

[Vitaliy S.]

Hey sandsturm,

Opening a case will not help, as support does not deal with FRs. There were no major product updates since your last request, so there is no change yet. However, I do remember about you and your FR is something we are planning to discuss for the release after v11 (currently in the code freeze stage).

Thanks!

[sandsturm]

okay, thank you. Would be great to see this solved

[Newod]

Have you tried to review how parameters are passed in the batch scripts from the KB article?

[wishr]

Hi Newod,

Yes, we have a QC process in place that covers this usage scenario.

Thanks