Important

   

This documentation space contains information about PATROL Agents when deployed in a TrueSight Operations Management environment. If you are a BMC Helix Operations Management user, see PATROL Agent 22.1 for BMC Helix Operations Management. Open link

Setting event rules

The EventRules configuration variable allows you to define a list of persistent rules in the agent where each rule can be one of the following:

  • Event suppression rule: If an event is published in the context of a given KM, then you can suppress this event.
  • Event replacement rule: If an event is published in the context of a given KM (or application), then you can replace this event.
  • Event text substitution rule. This rule is similar to the event replacement rule except that only the description of the event is replaced. All other event attributes remain the same.

Format and type of data

/EventRules/sourceCatalog/sourceClass/objectPath

Values (no default)

SUPPRESS
REPLACE=(replacementCatalog, replacementClass)
SUBSTITUTE=replacementEventDescriptionText
SUBSTITUTE=numericMessageID

Minimum and maximum

Not applicable

DependenciesNone
RecommendationNone

Note

Only ONE rule can exist for a given KM context, event catalog and event class. This is inherently enforced by the fact that only one such pconfig variable can exist.

If many rules exist that match the objectPath of an event, the following order is applied:

  1. application/ instance id/ parameter
  2. application/__ANYINSTANCE__/ parameter
  3. application/ instance id
  4. application/__ANYINSTANCE__
  5. application

If <objectPath> is '*' (an asterisk), any event with the same catalog and class will match the rule.

Suppress an event

To suppress an event means that you want to suppress event source catalog, source class anytime the event origin matches objectPath.

Example

Key: /EventRules/STD/UpdInstState/NT_CPU/NT_CPU
Value: SUPPRESS

Any UpdInstState Event published in the context of the application instance NT_CPU/NT_CPU will be suppressed.


When an event is suppressed following tasks are observed:

  • No event action is ran
  • No SNMP trap is triggered

Some standard events that are used internally by the agent (example remote PSL execution) can be suppressed (with limitations):

  • Event class "7" — login OK
  • Event class "28" — login invalid
  • Event class "RemPsl" — launch remote PSL execution
  • Event class "Result" — return result of remote PSL execution
  • Event class "39" — value of parameter not in range
  • Event class "11" — value of parameter is in alarm zone
  • Event class "9" — alarm has been cancelled.
  • Event class "40" — response event

Some of the events generated for PATROL objects that are blacked out but can be suppressed (with limitations):

  • BlackoutStart event
  • BlackoutStop event

Note

If you suppress any of the above mentioned events, neither will any event get generated nor will any event actions run. Only range evaluations will take place and recovery events will get generated. Example:

  • Event class "RemPsl" — launch remote PSL execution events will not get displayed
  • Event class "Result" — return result of remote PSL execution will not be shown
  • Event class "BlackoutStart" — event will not get generated.
  • Event class "BlackoutStop" — event will not get generated

Replace an event

The event replacement rule allows you to replace standard events with more meaningful events for each KM. To replace an event means that you want to replace event source catalog, source class with event replacement catalog, replacement class anytime the event origin matches objectPath.

Example

Key: /EventRules/STD/11/NT_CPU
Value: REPLACE=(MY_CAT,MyClass)

Any instance of Standard Event 11 published in the context of application NT_CPU will be replaced by an instance from event class MyClass and catalog MY_CAT. Because the context of the rule is NT_CPU, the rule will apply to any event with the following origin:

  • NT_CPU,
  • NT_CPU.CPU_0,
  • NT_CPU.CPU_0.CPUprcrUserTimePercent
  • NT_CPU...CPUprcrUserTimePercent

If MY_CAT/MyClass does not exist, the original event will be published. 

It is expected that event class "MyClass" defines the same number of arguments as in event class "11".

  • If event "MyClass" has more arguments than "41", the extra replacement arguments will not be expanded.
  • If event "MyClass" has less arguments than "41" then the extra source arguments will be ignored.

Some standard events are used internally by the agent (example remote PSL execution) and, as such, cannot be replaced:

  • Event class "7" — login OK
  • Event class "28" — login invalid
  • Event class "RemPsl" — launch remote PSL execution
  • Event class "Result" — return result of remote PSL execution
  • Response event

Substitute event text

To substitute event text means that you want to substitute the event description of event source catalog, source class with the substitute text when the event origin matches objectPath. Event text substitution allows you to provide event descriptions that are in context of your environment and more meaningful.

Example

  • Key: /EventRules/STD/28/NT_CPU/NT_CPU/CpuPercent
    Value: SUBSTITUTE=User %s cannot be authenticated

    When event "28" is to be published in the context of computer "NT_CPU/NT_CPU/CpuPercent', the original description "Login denied for user '%s' -- invalid username/password or wrong ACL." will be substituted with "User %s cannot be authenticated".
  • A user defined configuration branch "/MyConfig/config1/agenthost-01_test" = { REPLACE = "This is message from nested Macro."}, can be used in the event replacement rule as follows:

    Key: /EventRules/STD/11/NT_CPU/CPU_0/CPUprcrUserTimePercent

    Value: SUBSTITUTE= Nested with user defined config branch:%{//pcfg/MyConfig/config1/%{/hostname}_test}

    When event "11" is to be published in the context of computer "/NT_CPU/CPU_0/CPUprcrPrivTimePercent", the original description "Alarm #2 of global parameter 'CPUprcrUserTimePercent' triggered on 'NT_CPU.CPU_0'. 95 <= 98.00 <= 100" will be substituted with "Nested with user defined config branch:This is message from nested Macro".
  • If you have defined CustomId1 using the Event Management KM:

    Key:/AS/EVENTSPRING/NT_MEMORY/NT_MEMORY/MEMmemPagesInputPerSec/customId1

    Value:This is message from customid1 defined using EM KM.

    This configuration variable can be used in the event replacement rule as follows:

    Key:/EventRules/STD/11/NT_MEMORY/NT_MEMORY/MEMmemPagesInputPerSec

    Value:SUBSTITUTE=Message substitution using LOOKUP
    Macro:%{LOOKUP:/AS/EVENTSPRING/customId1}

    When event "11" is to be published in the context of "/NT_MEMORY/NT_MEMORY/MEMmemPagesInputPerSec", the original description "Alarm #1 of global parameter 'MEMmemPagesInputPerSec' triggered on 'NT_MEMORY.NT_MEMORY'. 0 <= 99.00 <= 99" will be substituted with "Message substitution using LOOKUP Macro:This is message from customid1 defined using EM KM."

Example

Using Event Macros:

Key:/EventRules/STD/9/NT_LOGICAL_DISKS/D:/LDldDiskSpaceUsed

Value:SUBSTITUTE= Alarm cancelled on Instance:%{INSTANCE_NAME}, on Paramater: %{PARAMETER_NAME}

When event "9" is to be published in the context of "/NT_LOGICAL_DISKS/D:/LDldDiskSpaceUsed", the original description "Alert on 'NT_LOGICAL_DISKS.D:.LDldDiskSpaceUsed' from global parameter 'LDldDiskSpaceUsed' cancelled; exception no longer exists." is substituted with "Alarm cancelled on Instance:Data (D:), on Paramater: LDldDiskSpaceUsed".

As in the event replacement rule, it is expected that the substitute description defines the same number of arguments as in the original description.

Was this page helpful? Yes No Submitting... Thank you

Comments