Creating automation policies

Automation engineers or developers create automation policies to remediate issues or problems based on the events generated in BMC Helix Operations Management or BMC Helix AIOps. Automation policies contain actions that connect with the automation applications supported by BMC Helix Intelligent Automation to perform remediation actions for events.

You can either create policies directly or create them for a requested event, displayed in the Requests page. A policy runs only if it is in a published state.

To create an automation policy

Perform the following steps to create an automation policy.

Step 1: To provide the policy information and specify the execution mode

In the BMC Helix Intelligent Automation console, go to Policies and click Create Automation Policy.
In the Policy Information section, enter a unique name and an optional description for the policy.
Select the execution mode as Manual or Automatic depending upon whether you want to execute the policy manually or automatically based on the incoming events.
Can I change the execution mode later?

Yes, you can edit the policy and change the mode anytime.

Step 2: To define the trigger condition to match the incoming event

In the Trigger section, click Browse, and do one of the following:
- From the Select Event Type tab, select an existing event type and click Done.
  The trigger condition from the event is listed in the following format: <eventCategory>: <eventName>.
  Important
  
  Where do these event types come from?
  Out of all incoming events, BMC Helix Intelligent Automation shows the latest event for each event type (in case of multiple events of the same type but with different values).
  Why don't I see any existing event types to choose from?
  Out of a huge number events, BMC Helix Intelligent Automation chooses events from each type randomly as a sample. Hence, either the product has not received any events from the source or it may take a while for the event types to be listed.
- On the Paste Event JSON tab, enter the event information in the JSON format, and click Done.
When you select an event, all parameters in the event appear in the right pane.
Click anywhere in the Trigger Condition box to start building the expression for a trigger condition, and use the suggested parameters, values, and operators to complete the expression.
For sample expressions, see Trigger condition expression.

Step 3: To select actions to be run as part of the policy

To add action to the policy, click Add Action and perform the following steps using the action wizard:
1. From the Pick an automation tool section, click the connector name.
  Only configured connectors are displayed here. The wizard takes you to the next step to select an action.
2. Click Sync Actions.
  All actions available in the selected connector appear.
3. Click Select against the action that you want to add to the policy.
  The wizard takes you to the next step to configure an action.
4. Depending on the selected action, provide the information and click Done.
  Note
  
  Based on the selected event, the event slots with the values specified in the event appear under the Parameters section on the UI. You can click any of the parameters and its value gets copied. You can paste it while defining the action in the policy.
  The added action appears in the Action Configuration section. You can add multiple actions in a policy.
  Adding action for supported applications
  To add action for a specific automation application, see the following documentation for an example for each of the supported connections:
  - Terminating, starting, or stopping an EC2 instance (AWS)
  - Restarting PATROL Agent on a server (Ansible Tower)
  - Resizing a deployment (Kubernetes)
  - Executing a workflow (TrueSight Orchestration)
  - Running a job in Jenkins (Generic REST API)
  - Invoking a process in BMC Helix Innovation Studio (BMC Helix Innovation Suite)

Step 4: To add tags

To add system or custom tags to the policy, perform the following steps:
1. System tags: Select one or more tags from the list of available system tags.
  Based on the event, some system tags are displayed.
2. Custom tags: In the Tags (Optional) section, enter a key-value pair.
  Tag key should start with an alphabet and end with an alphanumeric character. Key supports alphanumeric characters and periods, dashes, and underscores.

Step 5: To configure change management for creating change requests

To create a change request as part of this policy, perform the following steps:

If not enabled already, use the Enable change ticket creation toggle button and then click Modify to add change request values.
Select the appropriate values for the following fields and click Save:
1. Impact
2. Urgency
3. Company
4. First Name: By default, first and last name of the logged-in user appears.
  When you enter the first name, based on the selected company, the list of user names belonging to that company appear in a list in the <username-firstname-lastname> format. If there are multiple users with the same first name, you can select the correct user from the list. When you select the first name, the last name gets selected.
5. Last Name
6. Description: By default, contains the name of the product, BMC Helix Intelligent Automation. The description is updated in the Summary field in the change request in BMC Helix ITSM. Ensure that the description is up to 100 characters only.
  The selected values are displayed. When a change is created in BMC Helix ITSM, it will contain the values specified in the policy.
  
  Note
  
  In case the user credentials for the BMC Helix ITSM get changed for the tenant, it takes 15 minutes to reflect the changes in BMC Helix Intelligent Automation. In this time period, if the the policies with change management options are triggered, they fail and display an authentication failed error. After 15 minutes, if the policies are triggered again, they will successfully run.
  After the change request is approved in BMC Helix ITSM, the policy is triggered and runs the actions.

Step 6: To provide estimated savings

In the Estimated Savings section, enter an approximate time (in minutes) and money (in USD) that you may save by automating the actions.
Continue to the next step

Step 7: To configure notifications and publish policy

By default, the Generate Information Event on execution check box is selected. Every time this policy runs, an information event (AUTOMATION_STATUS_EV class) is generated in BMC Helix Operations Management.

Important

For policies that are already created, information events are generated in BMC Helix Operations Management. If you do not want the information events, edit a policy and clear the check box.
If you clear the check box:
- Policy execution is not counted in the Automation Runs count in BMC Helix Intelligent Automation Value Dashboard. For more information, see Viewing policies in BMC Helix Dashboards.
- If users run this automation policy from BMC Helix AIOps, the status of the policy in BMC Helix AIOps still shows Running even if the policy may have run successfully.
If you do not want to generate information events of the type Automation_Status_EV in BMC Helix Operations Management for the out-of-the-box policies created as part of solutions (Blackout Policy or Proactive Service Resolution), then you must configure the solution again. If you configure the solution again, automation status information events are not generated.

Select Publish Policy and click Save.

(Optional step) To test a policy

When creating a policy, you can select an event from the list of events that have occurred in BMC Helix Operations Management. BMC Helix Intelligent Automation listens to BHOM over a period of time and shows a list of event types to make it easy to build policies. For testing, BMC Helix Intelligent Automation uses the event data selected as part of the policy creation process. It does not create a new event, or wait for a new event coming from BMC Helix Operations Management.

However, changing the trigger conditions may cause the policy to fail during testing if the new conditions don't match the stored event type. For example, if you select a "Service Down" event to create a policy, BMC Helix Intelligent Automation uses a "Service Down" event stored in the product. If you change the trigger conditions, the test may fail if they don't match the stored event.

Click Test Policy.
You are prompted to save the policy.
Click Confirm.
On the Test Inputs tab, enter parameter values for testing (if required by the policy being tested).
Click Execute.
The results appear in the Test Results tab.
If the policy test is successful, the policy is created and executed on the resource you provide during testing.
Can I test a policy later?

Yes, however, you need to change a policy status to draft and edit the policy to test it. BMC recommends that you test a policy while creating it.

Trigger condition expression

To build a trigger condition expression, you can use the expression builder provided by BMC Helix Intelligent Automation while creating an automation policy. To learn more, see Trigger condition.

The following table lists sample conditions and the events that will match to those conditions:

Scenario Trigger condition example Description Sample event

Service is down

( $.event.msg == 'SERVICES_Spooler Service status == 3 0 - Running, 1 - Ok not running, 2 - Warning not running, 3 - Alarm not running for 1 min.' ) && ( $.event.source_hostname == 'vw-host.com' ) && ( $.event.class like_regex '^.*ALARM.*$' )

Matches any event where msg equals

SERVICES_Spooler Service status == 3 0 - Running, 1 - Ok not running, 2 - Warning not running, 3 - Alarm not running for 1 min.

and source_hostname equals the hostname specified in the condition, and the class contains ALARM.

Click here to view a sample Windows Service Down event

{ 
    "msg": "SERVICES_Spooler Service status == 3 0 - Running, 1 - Ok not running, 2 - Warning not running, 3 - Alarm not running for 1 min.",
    "creation_time": 1598887988000,
    "_tenant_id": "1602985772",
    "incident_type": "",
    "al_baseline_weekly_low": "",
    "al_parameter_value": "3.0",
    "al_thresh_id": "NT_SERVICES:ServiceStatus:CRITICAL:1602985772:ALL",
    "modelname": "",
    "incident_operational_category1": "",
    "incident_operational_category2": "",
    "incident_operational_category3": "",
    "al_parameter_unit": "0 - Running, 1 - Ok not running, 2 - Warning not running, 3 - Alarm not running",
    "source_identifier": "bcc31a2d-****-****-****-ad4880bc2f71",
    "al_thresh_type": "USERDEFINED",
    "incident_id": "",
    "_service_id": "",
    "_operations": "[0x1744526ba09,admin,TSO CDP Service Down,Alarm (ALL),'']",
    "incident_company": "",
    "al_parameter_threshold": "3.0",
    "al_baseline_hourly_high": "",
    "details": "",
    "_modified_time": 1598888000442,
    "_notes": "[]",
    "al_event_score": "0",
    "al_avg_value": "",
    "al_old_severity": "UNKNOWN",
    "al_is_predicted": "FALSE",
    "al_alarm_id": "bcc31a2d-774e-4efe-99ec-ad4880bc2f71",
    "al_end_time": 4294967295000,
    "al_parameter_name": "ServiceStatus",
    "incident_category": "",
    "al_extremeness": 0,
    "priority": "PRIORITY_5",
    "object_id": "d7677983-953d-4554-88ee-168c1187891d:NT_SERVICES:SERVICES_Spooler",
    "al_thresh_above": "TRUE",
    "_node_id": "",
    "_identifier": "bcc31a2d-774e-4efe-99ec-ad4880bc2f71",
    "tags": "[]",
    "instancename": "",
    "_repeat_count": "0",
    "user_assigned": "",
    "componentalias": "",
    "al_pts_exceeded": "0",
    "al_baseline_daily_low": "",
    "al_highest_severity": "CRITICAL",
    "status": "OPEN",
    "object": "SERVICES_Spooler",
    "al_pts_total": "0",
    "sub_category": "OTHER",
    "al_baseline_daily_high": "",
    "al_last_time": "0",
    "_errors": "[]",
    "al_baseline_weekly_high": "",
    "_ci_id": "74ba8fda-fbf9-4f3b-a63b-decf23d5b776",
    "al_baseline_hourly_low": "",
    "source_address": "10.128.190.230",
    "source_port": "0",
    "cross_launch_uri": "",
    "alias": [
        "BMC_ComputerSystem:vw-pun-bao-pt01"
    ],
    "al_device_ipaddress": "176620902",
    "class": "ALARM",
    "object_class": "NT_SERVICES",
    "_lifecycle_time": "0",
    "severity": "CRITICAL",
    "al_thresh_duration": 60,
    "incident_item": "",
    "_arrival_time": 1598888000442,
    "al_prediction_severity": "UNKNOWN",
    "cdmclass": "",
    "al_agent_os": "Windows Server 2012 R2 Standard",
    "_unmapped_data": {
        "al_baseline_type": null
    },
    "al_agent_name": "vw-pun-bao-pt01",
    "al_predict_to_occur_time": "0",
    "al_agent_port": "3181",
    "_model": "",
    "location": "",
    "category": "OPERATIONS_MANAGEMENT",
   "source_hostname": "vw-pun-bao-pt01.bmc.com"
}

Overallocated containers

( $.event.tags.platform like_regex '^.*kubernetes.*$' ) && ( $.event.payload.resources[*].cluster like_regex '^.*vmcluster.*$' ) && ( $.event.payload.resources[*].namespace == 'adeint' )

Matches any event where the tags.platform contains kubernetes, payload.resources[*].cluster contains the name of the cluster and the payload.resources[*].namespace equals adeint.

Click here to view an overallocated container event

{
    "tags": {
        "event_type": "OVERALLOCATED_CONTAINER_RECOMMENDATION_REMOTE_PLUGIN",
        "platform": "kubernetes"
    },
    "payload": {
        "generated_by": {
            "product": "Optimize",
            "version": "21.05.00"
        },
        "resources": [
            {
                "resource_id": "?",
                "resource_name": "ade-reporting",
                "account_id": "?",
                "account_name": "?",
                "cluster": "aus-k8s-vmcluster",
                "namespace": "host1",
                "deployment": "adereporting",
                "current_cpu_request": 500,
                "current_cpu_limit": 1000,
                "current_memory_request": 2560,
                "current_memory_limit": 2560,
                "cpu_demand": 25,
                "cpu_demand_peak": 350,
                "memory_demand": 2227,
                "memory_demand_peak": 2227,     
                "tags": {
                    "Environment": [
                        "Trial"
                    ],
                    "Department": [
                        "Sales"
                    ]
                },
                "container_cpu_recommendation": {
                    "action": "reduce_cpu_allocation",
                    "recommended_cpu_request": "200m",
                    "reclaimable_cpu": 450,
                    "recommended_cpu_limit": "500m"
                },
                        "container_memory_recommendation": {
                    "action": "reduce_memory_allocation",
                    "recommended_memory_request": "128Mi",
                    "reclaimable_memory": 450,
                    "recommended_memory_limit": "1Gi"
                }
            }
        ]
    }
}

Stop an Amazon EC2 instance

$.event.event_type like_regex '^.*ec2_stop.*$' && $.event.region_code == 'us-east-1'

Matches any event where the event_type field contains ec2_stop and the region_code is us-east-1.

Sample event for AWS EC2 instance

{
    "event_type": "aws-ec2_stop",
    "region_code": "us-east-1",
   "resource_id": "i-07a07b95f94e69673"
}

Where to go from here

After successfully creating policies, you can view the automation policies in the console, see Viewing, editing, and copying automation policies.