---

Subject:	*** BUMP ***
Author:	[Not Specified]
Posted:	2017-01-17 08:59

*** BUMP ***

Anyone

The problem is we can actually get values like "108% Used" because available_raw / available_gb can end up being greater than total_raw / total_gb.

How do you get the actual value of available / free memory that only include RAM

Here is the transformation we are currently using...

import re

regex = re.search('threshold of .*(swap|memory|Free).* (exceeded|restored|not met|Memory): current value ([\d\.]+)', evt.message, re.I)
if regex and device and (device.getDeviceClassPath().startswith("/Server/SSH/Linux") or device.getDeviceClassPath().startswith("/Server/Linux")):
linmem = re.search("current value ([\d\.]+)", evt.summary)
if linmem:
available = float(linmem.group(1))
total = device.hw.totalMemory
evt.component = "Memory"
if regex.groups()[0].lower() == "swap":
total = device.os.totalSwap
evt.component = "Swap"
evt.memoryavailable = available
evt.total = total
total_gb = (float(device.hw.totalMemory) / 1048576)
if total:
percent_free = (available / total) * 100
percent_used = ((total - available) / total) * 100
evt.summary = "High Memory Utilization: Currently %3.0f%% used of %3.1fMB (%3.0f%% free)" % (percent_used, total_gb, percent_free)
evt.message = evt.summary
else:
evt.summary = 'High Memory Utilization: Currently: %s' %(convToUnits(available))
evt.message = evt.summary
evt.message = evt.message + "\n\n--: SIQ Linux Memory :--"

if regex and device and device.getDeviceClassPath().startswith("/Server/Microsoft/Windows"):
winmem = re.search("current value ([\d\.]+)", evt.summary)
OriginalEvtMessage = evt.message
if winmem:
available_raw = float(winmem.group(1))
available_gb = float(winmem.group(1)) * 1024
total_raw = device.hw.totalMemory
total_gb = (float(device.hw.totalMemory) / 1073741824)
#percent_used = (1 - (available / total)) * 100
percent_free = ((total_raw - available_raw) / total_raw) * 100
percent_used = (available_raw / total_raw) * 100
evt.summary = "Memory Threshold Alert - Used: %3.1f%% / Free: %3.1f%%" % (percent_used, percent_free)
evt.message = evt.message + "\n\n--: SIQ Windows Memory :--"
evt.message = evt.message + "\ntotal_raw: " + str(total_raw)
evt.message = evt.message + "\ntotal_gb: " + str(total_gb)
evt.message = evt.message + "\navailable_raw: " + str(available_raw)
evt.message = evt.message + "\navailable_gb: " + str(available_gb)
evt.message = evt.message + "\npercent_used: %3.1f%%" % (percent_used)
evt.message = evt.message + "\npercent_free: %3.1f%%" % (percent_free)
evt.message = evt.message + "\n\n--: OriginalEvtMessage :--"
evt.message = evt.message + OriginalEvtMessage

---

Subject:	WinRM Memory Thresholds Resolved!
Author:	[Not Specified]
Posted:	2017-01-30 15:14

We had to create an additional Data Source using the "\Memory\Available bytes" perfmon counter.

- Used the MemoryAvailableBytes Datapoint to pull the current available and with the transform were able to successfully calculate the percentage used/free

- Used the following values for the escalating thresholds:

Warning: Minimum Value - here.hw.totalMemory * .2 Maximum Value - here.hw.totalMemory * .100001

Error: Minimum Value - here.hw.totalMemory *.1 Maximum Value - here.hw.totalMemory *.0500001

Critical: Minimum Value - here.hw.totalMemory * .05

Windows portion of our Transform:

# Converts memory events into percentage with raw values
import time, re, logging

match = re.search('threshold of .*(swap|memory).* (exceeded|restored|not met|violated): current value ([\d\.]+)', evt.message, re.I)
if match and device:
available = float(match.groups()[2])
total = device.hw.totalMemory
evt.component = "Memory"
if match.groups()[0].lower() == "swap":
total = device.os.totalSwap
evt.component = "Swap"
evt.current = available
if total:
percent_free = (available / total) * 100
percent_used = ((total - available) / total) * 100
evt.summary = "High Memory Utilization: Currently %3.0f%% used (%3.0f%% free)" % (percent_used, percent_free)
evt.message = evt.summary
else:
evt.summary = 'High Memory Utilization: Currently: %s' %(convToUnits(available))
evt.message = evt.summary

sum=evt.summary
if (sum.find("cbsModuleFreePageAvailableNorm") >= 0):
sum=re.sub ("cbsModuleFreePageAvailableNorm", "cbsModuleFreePageAvailableHigh", sum)
evt.summary=sum
evt.message = evt.summary
evt._action="history"