Generating events from logs

Use events to notify yourself about an issue before your users notice them. For example, while analyzing logs, you come across a condition such as status 401 for which you want to be notified. Let's say, you notice that status 401 is reported multiple times in a short time period. You want to be notified if it occurs again. Use alert policies to be notified about such conditions. When the conditions configured in the alert policies occur in the logs, you are notified with the help of events that are generated in BMC Helix Operations Management.

Alert policy details

An alert policy consists of the following details:

  • Name, description, and precedence.
  • Policy selection criteria or the conditions that generate an event. Configure the policy selection criteria based on the fields available in the logs. The operators that you can use are Equals, Not Equal to, and Contains. Combine these conditions with the AND and OR logical operators. Optionally, group these conditions on a particular field, such as when status Equals 401 for a particular host. In this case, you group the condition on the host field. Next, define the time period for these conditions to be true. As an example, generate an event if status Equals 401 for 5 times (minimum) in the past 10 minutes.  

    Important

    While using the Contains operator in the policy selection criteria, ensure that you use the complete word present in the log string of a field. For example, if the value of the Country field is "United States of America", set the criteria as Country Contains United or Country Contains America. Do not set the criteria for partial words, such as Country Contains Unite or Country Contains Amer. 

  • Host name, which can be either a static value that you type or a field in the logs that you select. If you select a log field, ensure that you select the same log field in the Group by field. 
  • Additional Details are the values from the logs that are added to the fields of the generated event. These values can be either static values that you type or a field in the logs that you select. The additional details that you can add to the event are described as slots on this page:  Log Alert event class Open link . Fields of type Enum accept only preconfigured values. If you enter a value that is not preconfigured, the default value is added to the slot in the event. To add custom fields to an event, see Managing events with REST APIs. Open link .  

To create an alert policy

The following video (3:02) illustrates the steps to create an alert policy.


https://youtu.be/363A--xCKfs

  1. Click the Alerts menu.
  2. On the Alert Policies page, click Create.
  3. Enter a unique name such as Authentication Failure, and an optional description.
  4. In the Precedence field, set a precedence for the policy.
    Note that the lower the number, the higher the precedence. Policies are applied in the ascending order of precedence.
  5. In the Policy Selection Criteria field, configure the condition for which the event will be generated.
    For example, enter status Equals 401. When you click in the box, you are prompted to make a selection after which, you are progressively prompted to make another selection.
  6. In the Group by field, to group occurrences of a condition, enter the values by which you want to group.
    For example, to group all occurrences of status 401 on a particular host name, enter the host name. You can enter a maximum of three values, but one must be the host name.
    Alternatively, you can add a host name from a log field. Click in the field and select an appropriate option.
  7. In the Alert Condition field, decide how many times the condition must occur in a time period to generate the event and the status of the event and enter and select the values in the Minutes, Minimum count is, and Alert fields.
    For example, when status 401 is reported a minimum of 50 times within a 5-minute period, a critical event is generated.
  8. In the Alert Parameters section, in the Hostname field, enter or select a host name that is added to the event.
    To add a host name from a log field, click in the field and select the appropriate option. This value helps you correlate events in BMC Helix AIOps. 
  9. In the Message field, change the default message, if required.
    To use a log field value in the message, put double curly brackets around the field name such as {{ $.location }}.
  10. In Additional Details, configure additional event parameters like source identifier.
    These values are set for the generated event.
  11. Select Enable Policy.
  12. Save the policy.
    View all your policies on the Alert Policies page. To edit, enable, disable, or delete a policy, use the Actions menu.

To understand the number of events generated

Let's consider the following examples to understand how many events are generated.

Configurations in an alert policyIncoming logsNumber of events generatedDetails

Policy selection criteria: status Equals 401

Group by: blank

Hostname: blank or static value

For last: 5 minutes; When minimum count is: 10

The condition is satisfied 22 times in the last 5 minutes.1The event is generated after the criteria is satisfied the first 10 times in the logs. When it is satisfied another 10 times, for the same event, the Repeated count field is updated as 1.

Policy selection criteria: status Equals 401

Group by: hostname

Hostname: $.hostname

For last: 5 minutes; When minimum count is: 10

The condition is satisfied 11 times for host 1 and 20 times for host 2 in the last 5 minutes.2
  • One event is generated for host 1 because the criteria for it is satisfied 11 times.
  • One event is generated for host 2 after the criteria is satisfied the first 10 times in the logs. When it is satisfied another 10 times, for the same event, the Repeated count field is updated as 1.

Policy selection criteria: status Equals 401

Group by: blank

Hostname: host 1 (static value)

For last: 5 minutes; When minimum count is: 10

The condition is satisfied 11 times for host 1 in the last 5 minutes.1

The event is generated for host 1 because the criteria for it is satisfied 11 times.

Policy selection criteria: status Equals 401

Group by: city

Hostname: host 1 (static value)

For last: 5 minutes; When minimum count is: 10

The condition is satisfied 11 times for host 1 and city 1 and 20 times for host 1 and city 2 in the last 5 minutes.2
  • One event is generated for host 1 and city 1 because the criteria for it is satisfied 11 times.
  • One event is generated for host 1 and city 2 after the criteria is satisfied 10 times in the logs. When it is satisfied another 10 times, for the same event, the Repeated count field is updated as 1.

Policy selection criteria: status Equals 401

Group by: hostname, city, and country

Hostname: $.hostname

For last: 5 minutes; When minimum count is: 10

The condition is satisfied 11 times for host 1, city 1, and country 1 and 20 times for host 2, city 2, and country 2 in the last 5 minutes2
  • One event is generated for host 1 because the criteria for host 1, city 1, and country 1 is satisfied 11 times.
  • One event is generated for host 2 after the criteria is satisfied 10 times for host 2, city 2, and country 2. When it is satisfied another 10 times, for the same event, the Repeated count field is updated as 1.

To view the generated events

  1. Click the Alerts menu.
  2. Select Events.
    The Events page in BMC Helix Operations Management is displayed. The class of these events if Log Event. Use it to filter events generated by using alert policies. For more information about events, see Monitoring and managing event Open link
    To view these events in BMC Helix Dashboards, navigate to Dashboards > Manage Dashboards > Log Analytics, and click the Self Monitoring dashboard.

Using the events to analyze logs

When you configure alert policies and the condition configured in a policy is satisfied in the logs, events are generated in BMC Helix Operations Management. The class of these events is Log Event. To continuously track such events, use the Self Monitroing dashboard available in the Log Analytics folder in BMC Helix Dashboards.

In the Others > Search Parameters field of the event, the link to launch BMC Helix Log Analytics. When you click this link, the Explorer opens in BMC Helix Log Analytics and the logs that generated the event are displayed.

If the host name is present as a configuration item (CI) for a service in BMC Helix AIOps, you can monitor the generated events in BMC Helix AIOps. For a CI of a service or the host name, these events are correlated in BMC Helix AIOps.

 

Related topic

Creating and managing alert policies with REST APIs

Was this page helpful? Yes No Submitting... Thank you

Comments