Failed at applying specific threshold to the node

I noticed that the package filter can’t filter which threshold I want to apply to the node. the filter setting is in threshd-configuration.xml

here is my settings:

  <package name="289">
    <filter>(foreignid == '1657166812842' &amp; foreignsource == 'A')</filter>
    <include-range begin="1.1.1.1" end="254.254.254.254"/>
    <include-range begin="::1" end="ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff"/>
    <service name="SNMP" interval="300000" user-defined="false" status="on">
      <parameter key="thresholding-group" value="289_01"/>
      <parameter key="thresholding-group" value="289_02"/>
      <parameter key="thresholding-group" value="289_03"/>
    </service>
  </package>
  <package name="288">
    <filter>(foreignid == '1657166849154' &amp; foreignsource == 'B')</filter>
    <include-range begin="1.1.1.1" end="254.254.254.254"/>
    <include-range begin="::1" end="ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff"/>
    <service name="SNMP" interval="300000" user-defined="false" status="on">
      <parameter key="thresholding-group" value="288_01"/>
      <parameter key="thresholding-group" value="288_02"/>
      <parameter key="thresholding-group" value="288_03"/>
    </service>
  </package>

The recent events from node id 289, which foreignid is 1657166812842:

2776377	2022-07-19T17:19:59+08:00	Warning	High threshold exceeded for service SNMP metric ifInDiscards + ifOutDiscards on interface ens192/192.168.2.105
2776376	2022-07-19T17:19:59+08:00	Warning	High threshold exceeded for service SNMP metric ifInDiscards + ifOutDiscards on interface ens192/192.168.2.105

Event 2776376’s Description:

A high threshold for the following metric exceeded: ifLabel="ens192-
000c297f9b4a" ifIndex="2" label="ens192" ds="ifInDiscards + ifOutDiscards" 
description="289_02:Trigger an alert if one or more incoming or outgoing packets
 on an interface were discarded even though no errors were detected (possibly to
 free up buffer space) for two consecutive measurement intervals" value="1.06"
 instance="2" instanceLabel="ens192-000c297f9b4a" resourceType="if" 
resourceId="node[289].interfaceSnmp[ens192-000c297f9b4a]" threshold="1.0" 
trigger="2" rearm="0.0"

Event 2776377’s Description:

A high threshold for the following metric exceeded: ifLabel="ens192-
000c297f9b4a" ifIndex="2" label="ens192" ds="ifInDiscards + ifOutDiscards"
 description="288_02:Trigger an alert if one or more incoming or outgoing packets
 on an interface were discarded even though no errors were detected (possibly to
 free up buffer space) for two consecutive measurement intervals" value="1.06" 
instance="2" instanceLabel="ens192-000c297f9b4a" resourceType="if" 
resourceId="node[289].interfaceSnmp[ens192-000c297f9b4a]" threshold="1.0" 
trigger="2" rearm="0.0"

The two thresholds’ setting is exactly the same, the only difference is the description text.

node 289 has an event 2776377, its description text includes string 288_02:, which means Meridian has triggered the package name=“288” for me, but the result is not my will to see.

Expected outcome:
node 289 won’t be apply thresholding-group: 288_02

OpenNMS version: Meridian 2020.1.3

Filter field names are case sensitive, iirc.

You can validate filters with the Karaf shell command opennms:filter

@dino2gnt I tested, but it seems no case sensitive… :thinking:
and the result is the same as I thought.

admin@opennms> opennms:filter "foreignID == '1657166812842' & foreignSource == 'A'"

nodeId=289 nodeLabel=threshold-289 location=Default
	categories:
		yue		snmp1	IpAddresses:
		172.19.0.1
		192.168.2.105
		172.17.0.1
		172.18.0.1
		192.168.32.1
admin@opennms> opennms:filter "foreignid == '1657166812842' & foreignSource == 'A'"

nodeId=289 nodeLabel=threshold-289 location=Default
	categories:
		yue		snmp1	IpAddresses:
		192.168.2.105
		172.18.0.1
		192.168.32.1
		172.19.0.1
		172.17.0.1
admin@opennms> opennms:filter "foreignid == '1657166849154' & foreignsource == 'B'"

nodeId=288 nodeLabel=threshold-288 location=Default
	categories:
		yue		snmp2	IpAddresses:
		172.17.0.1
		172.18.0.1
		192.168.32.1
		192.168.2.81
		172.19.0.1
		192.168.2.105
admin@opennms>

Btw, I also test with no &amp;, like:

  <package name="289">
    <filter>foreignId == '1657166812842'</filter>
    <include-range begin="1.1.1.1" end="254.254.254.254"/>
    <include-range begin="::1" end="ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff"/>
    <service name="SNMP" interval="300000" user-defined="false" status="on">
      <parameter key="thresholding-group" value="289_01"/>
      <parameter key="thresholding-group" value="289_02"/>
      <parameter key="thresholding-group" value="289_03"/>
    </service>
  </package>
  <package name="288">
    <filter>foreignId == '1657166849154'</filter>
    <include-range begin="1.1.1.1" end="254.254.254.254"/>
    <include-range begin="::1" end="ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff"/>
    <service name="SNMP" interval="300000" user-defined="false" status="on">
      <parameter key="thresholding-group" value="288_01"/>
      <parameter key="thresholding-group" value="288_02"/>
      <parameter key="thresholding-group" value="288_03"/>
    </service>
  </package>

But it failed too.

2778452	2022-07-20T10:30:08+08:00	Warning	High threshold exceeded for service SNMP metric ifInDiscards + ifOutDiscards on interface ens192/192.168.2.105
2778451	2022-07-20T10:30:08+08:00	Warning	High threshold exceeded for service SNMP metric ifInDiscards + ifOutDiscards on interface ens192/192.168.2.105

Event 2778452 is the surplus event. Description:

A high threshold for the following metric exceeded: ifLabel="ens192-
000c297f9b4a" ifIndex="2" label="ens192" ds="ifInDiscards + ifOutDiscards" 
description="288_02:Trigger an alert if one or more incoming or outgoing packets
 on an interface were discarded even though no errors were detected (possibly to
 free up buffer space) for two consecutive measurement intervals" value="1.06"
 instance="2" instanceLabel="ens192-000c297f9b4a" resourceType="if" 
resourceId="node[289].interfaceSnmp[ens192-000c297f9b4a]" threshold="1.0" 
trigger="2" rearm="0.0"