Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?


Alarm Notification Configuration Overview

By default, the alarms generated by managed devices in the Junos Space platform are sent to the network monitoring functionality. To enable alarm notification for supported Junos Space applications, you can configure the alarmNotificationConf.xml file to specify the alarm notifications that designated Junos Space applications should receive. The applications will receive only those alarms that you configure in the alarmNotificationConf.xml file and that match the specified filter criteria.

You can configure basic and advanced filters so that any alarms that match the configured filtering conditions are forwarded to the designated applications.

Basic Filtering

You configure a basic filter to filter alarms based on the Unique Event Identifier (UEI), device family, and severity. At minimum, you must configure a UEI filter. Filtering by device family, severity, or both, is optional.

To configure a basic filter for alarm notification, at minimum, you must configure the following notification tags in the alarmNotificationConf.xml file, which must reside in the /opt/opennms/etc/alarm-notification directory:

  • Notification name

  • UEI of the alarm to be notified

  • The script to be executed for the configured UEI

You can also configure the following tags in the alarmNotificationConf.xml file:

  • Severity—Supported severity values are Indeterminate, Cleared, Normal, Warning, Minor, Major, and Critical.

    When configuring an alarm for notification, a notification is sent for the corresponding Clear Alarm. A notification is also sent after clearing an alarm from the user interface. To forward notification for Clear alarms and user interface (UI) , you must configure Severity = Normal, Cleared.

  • Device Family—Supported device family is present in the in the /opt/opennms/etc/alarm-notification.


    If the Sysoid for the device is unknown, the DevicesWithNoSysoid filter is matched.

Guidelines for Configuring Alarm Notifications

Use the following guidelines when configuring alarm notifications:

  • To send notification when an alarm is cleared from the UI, you must include event in the eventconf.xml file.

  • The event entry is present in /opt/opennms/etc/examples/alarm-notification/eventconf.xml. This entry should be added to /opt/opennms/etc/eventconf.xml.


    Do not copy and paste the entire /opt/opennms/etc/examples/alarm-notification/eventconf.xml file. If the event entry is not already present, append the event entry to the existing eventconf.xml file.

  • The tags listed in the /opt/opennms/etc/examples/alarm-notification/vacuumd-configuration.xml file should be added to the /opt/opennms/etc/vacuumd-configuration.xml file, if not already present.

  • Alarm notification dampening is performed based on the alarm counter. The notification_threshold attribute is added for this purpose. The default value is 5, which specifies that the first alarm is notified, then the sixth alarm, and so on.

Advanced Filtering

To provide more in-depth filtering, you must configure a drool (DRL) file. With advanced filtering, the applications receive only those alarms that match all the advanced filtering conditions. The name of the drool file and notification name mentioned in the alarmNotificationConf.xml file should match, and for each notification, there must be a drool file whose name matches the notification name. Each drool file that you configure must be added to the /opt/opennms/etc/alarm-notification/drools directory. You can view a sample drool file from the /opt/opennms/etc/examples/alarm-notification/drools directory. You can view a sample alarmNotification.xml file from the /opt/opennms/etc/examples/alarm-notification directory.


Care should be taken when writing the rule. For each rule that satisfies the condition, a corresponding script is invoked. For better performance, do not configure multiple rules for the same UEI.

You can create advanced filters based on any combination of the following fields:

  • alarmacktime

  • alarmackuser

  • alarmid

  • alarmtype

  • applicationdn

  • clearkey

  • counter

  • description

  • dpname

  • eventparms

  • eventuei

  • firsteventtime

  • ifindex

  • ifname

  • ipaddr

  • lasteventtime

  • logmsg

  • ossprimarykey

  • operinstruct

  • reductionkey

  • serviced

  • severity

  • suppressedtime

  • suppresseduntil

  • suppresseduser

  • tticketid

  • tticketstate

  • uiclear

  • x733Alarmtype

  • x733Probablecause