HPE OneView Alert Cleaner

Problem

In large enterprise environments with hundreds of HP servers:

• OneView accumulates numerous open alerts over time
• Many alerts remain open even after the triggering condition is resolved
• Manual cleanup of these alerts is time-consuming and impractical
• Excessive open alerts make it difficult to identify new, critical issues

Troubleshooting

Initial attempts to manage alerts faced several challenges:

1. Manual verification of each alert’s relevance
2. No built-in mechanism to automatically close resolved alerts
3. Need to identify truly old alerts vs. active issues
4. Required API interaction to programmatically manage alerts

Solution

Created a PowerShell script (OneView Alert Cleaner – OVAC) to automatically clean up old alerts:

Script: OneView Alert Cleaner (OVAC)

<#
.SYNOPSIS
Script: OneView Alert Cleaner (OVAC)
Version: 1.0 (Tested)
Date: Aug 1, 2024
Author: Kabir Ali - info@whatkabirwrites.nl
Description: This script will clear old open alerts in OneView. With the CutOffDate variable you can specify what will be considered as old alerts.
Version history:
0.1 - Aug 1 - Initial version
1.0 - Aug 7 - Final version

.EXAMPLE
.\OVAC.ps1 -ovServer "10.10.10.10" -ovDomain "local.domain" -ovUsername "Username" -ovPassword "VMware1!" -CutOffDate "5"
#>

Param (
    [Parameter(Mandatory = $true)][string]$ovServer,
    [Parameter(Mandatory = $true)][string]$ovDomain,
    [Parameter(Mandatory = $true)][string]$ovUsername,
    [Parameter(Mandatory = $true)][string]$ovPassword,
    [Parameter(Mandatory = $false)][string]$CutOffDate = "7"
)


# Function to request the AuthToken needed for the API
function AuthToken {
    # Login to OneView and get session token
    $body = @{
        userName = $ovUsername
        password = $ovPassword
        authLoginDomain = $ovDomain
        loginMsgAck = $true
    }
    $response = Invoke-RestMethod -Uri "$ovServer/rest/login-sessions" -Method Post -Body ($body | ConvertTo-Json) -ContentType "application/json" -Headers @{ "X-Api-Version" = "3800" }
    $authToken = $response.sessionID

    return $authToken
}

# Function to which will report all active and locked alerts
function AllAlerts {

    # Get active and locked alerts
    $AllAlertsUrl = "$ovServer/rest/alerts?start=0&count=-1&filter=""alertState NE 'Cleared'"""
    $AuthToken = AuthToken
    $AllAlertsResponse = Invoke-RestMethod -Uri $AllAlertsUrl -Method Get -Headers @{
        "Auth" = $authToken
        "X-Api-Version" = "3800"
    }

    # Output the alerts
    #$LockalertsResponse | ConvertTo-Json -Depth 3

    return $AllAlertsResponse

}

# Function to which will report only active alerts
function ActiveAlerts {

    # Get active alerts
    $alertsUrl = "$ovServer/rest/alerts?start=0&count=-1&filter=""alertState EQ 'Active'"""
    $AuthToken = AuthToken
    $alertsResponse = Invoke-RestMethod -Uri $alertsUrl -Method Get -Headers @{
        "Auth" = $authToken
        "X-Api-Version" = "3800"
    }

    # Output the alerts
    #$alertsResponse | ConvertTo-Json -Depth 3

    return $alertsResponse
}

# Function to which will report only locked alerts
function LockedAlerts {

    # Get locked alerts
    $LockalertsUrl = "$ovServer/rest/alerts?start=0&count=-1&filter=""alertState EQ 'Locked'"""
    $AuthToken = AuthToken
    $LockalertsResponse = Invoke-RestMethod -Uri $LockalertsUrl -Method Get -Headers @{
        "Auth" = $authToken
        "X-Api-Version" = "3800"
    }

    # Output the alerts
    #$LockalertsResponse | ConvertTo-Json -Depth 3

    return $LockalertsResponse

}

# Function to which will clear the alert
function DeleteLockedAlerts {
    Param (
        [string]$AlertID
    )

    # Delete locked alerts
    $DelLockalertsUrl = "$($ovServer)$($AlertID)?force=true"
    $AuthToken = AuthToken
    $DelLockalertsResponse = Invoke-RestMethod -Uri $DelLockalertsUrl -Method Delete -Headers @{
        "Auth" = $authToken
        "X-Api-Version" = "200"
    }

}

### MAIN CODE ###

# Suppress SSL errors
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}

# Add https:// to ovServer
$ovServer = "https://$($ovServer)"

# Lookup all the active alerts in OneView
$AllAlerts = AllAlerts

# Get the current date and time
$currentDate = Get-Date

# Calculate the cutoff date (default: 7 days ago)
$cutDate = $currentDate.AddDays(-($CutOffDate))


# Filter the alert objects where 'created' date is older than 7 day
$filteredAlerts = $AllAlerts.members | Where-Object {
    # Convert the 'created' property to DateTime and compare
    [DateTime]::Parse($_.created) -lt $cutDate
}

if ($filteredAlerts.count -gt 0) {
    # Display number of alerts to be cleared
    Write-Output "Found a total of $($filteredAlerts.count) alerts to clear"
    # Loop and clear alerts
    foreach ($Alert in $filteredAlerts) {
        Write-Output "Resource Name: $($Alert.associatedResource.resourceName)"
        Write-Output "Alert description: $($Alert.description)"
        Write-Output "Corrective Action: $($Alert.correctiveAction)"
        DeleteLockedAlerts -AlertID $Alert.uri
    } 
} else {
        Write-Output "No alerts found older than $($cutDate)"
}

Script Functionality

1. Authenticates with OneView using provided credentials
2. Retrieves all active and locked alerts
3. Filters alerts based on a cutoff date (default: 7 days)
4. Automatically clears alerts older than the cutoff date

Usage Example

.\OVAC.ps1 -ovServer "oneview01.local.domain" -ovDomain "local.domain" -ovUsername "Username" -ovPassword "VMware1!" -CutOffDate "5"

Sample Output

When alerts are found:

Found a total of 1 alert(s) to clear 
Resource Name: Backup Alert
Description: The backup has not been taken and downloaded for over 50 hours. 
Corrective Action: Create and download a backup...

When no alerts need clearing:

No alerts found older than 08/01/2024 10:25:24