Example of configurations required for a custom use case

Scenario: Suppose you see the following event on the TrueSight console indicating that more than 75% memory is getting utilized on a particular computer.

You want to perform triage to see the top 10 processes that are consuming the maximum memory on the affected computer.

Before you begin

Ensure that the requirements for TrueSight Orchestration and requirements for Presentation Server are already met.

Configure the custom use case for the example scenario on TrueSight Orchestration

On TrueSight Orchestration, create a custom use case for getting details of the top 10 processes that are consuming the maximum memory. For more information, see Example of adding a custom use case.

Configure event selection for the example scenario on Presentation Server

Configure event selection to enable the custom Orchestration action on Linux events with the memory parameter value greater than 75%.

This step is optional. If you do not perform this step, the custom Orchestration action will be displayed on all the events irrespective of context. With the result, each time you want to run the custom orchestration action, you need to first analyze the event and ensure that it is correct and relevant to the use case.

Based on the version of Presentation Server that you are using, you can either manually configure event selection or you can create an Orchestration policy to configure event selection. Orchestration policies are supported from version 11.3.03 of TrueSight Infrastructure Management.

•  If you are using version 11.3.02 of Presentation Server

  Perform the following steps:

  1. Navigate to the %TRUESIGHTPSERVER_HOME%\truesightpserver\conf\ directory and open the aoActionsContextConditions.json file.

     Tip

     Ensure that word wrap is turned on while viewing the aoActionsContextConditions.json file for a better viewing experience.

     Best practice

     Before you make any changes in the aoActionsContextConditions.json file, ensure that you back it up.

  2. Copy all the contents of aoActionsContextConditions.json file in a JSON viewer.

  3. Copy the following lines:

     Example of the new condition lines added for selecting memory events on Linux

     {"condition_order":18,"slot_name":"mc_parameter_value","condition_bracket":"","condition_operator":"AND","slot_operator":"greater_than","slot_value":"1.0","end_bracket":"))"}]}},
     {"aoaction_id":"BMC_TrueSight-MemoryUtilization-1",  "advanceFilter":{"name":"","eventClass":"ALARM","status":"","severity":"","application":"","service":"","groups":"","devices":"","monitors":"","global_filter":0,"filter_type":1,"filterConditions":[{"condition_order":0,"slot_name":"mc_ueid","condition_bracket":"","condition_operator":"AND","slot_operator":"equals","slot_value":"DUMMY","end_bracket":""},{"condition_order":1,"slot_name":"status","condition_bracket":"","condition_operator":"AND","slot_operator":"not_equals","slot_value":"CLOSED","end_bracket":""},{"condition_order":2,"slot_name":"mc_object_class","condition_bracket":"","condition_operator":"AND","slot_operator":"equals","slot_value":"NUK_Memory","end_bracket":""},{"condition_order":3,"slot_name":"mc_parameter_value","condition_bracket":"","condition_operator":"AND","slot_operator":"greater_than","slot_value":"75","end_bracket":""}]}}

  4. In the JSON viewer, add the copied lines at the end of the contents in the following way:

     • Add the copied lines on a new line after the line for "condition_order":18 and before the last two paranthesis.

     • Before the copied lines, ensure that you add a comma separator as shown in the following example.

     Example of the new condition lines added for selecting memory events on Linux

     {"condition_order":18,"slot_name":"mc_parameter_value","condition_bracket":"","condition_operator":"AND","slot_operator":"greater_than","slot_value":"1.0","end_bracket":"))"}]}},
     {"aoaction_id":"BMC_TrueSight-MemoryUtilization-1",  "advanceFilter":{"name":"","eventClass":"ALARM","status":"","severity":"","application":"","service":"","groups":"","devices":"","monitors":"","global_filter":0,"filter_type":1,"filterConditions":[{"condition_order":0,"slot_name":"mc_ueid","condition_bracket":"","condition_operator":"AND","slot_operator":"equals","slot_value":"DUMMY","end_bracket":""},{"condition_order":1,"slot_name":"status","condition_bracket":"","condition_operator":"AND","slot_operator":"not_equals","slot_value":"CLOSED","end_bracket":""},{"condition_order":2,"slot_name":"mc_object_class","condition_bracket":"","condition_operator":"AND","slot_operator":"equals","slot_value":"NUK_Memory","end_bracket":""},{"condition_order":3,"slot_name":"mc_parameter_value","condition_bracket":"","condition_operator":"AND","slot_operator":"greater_than","slot_value":"75","end_bracket":""}]}}

     Notice the AO action ID is set to BMC_TrueSight-MemoryUtilization-1 and the event class is set to ALARM. 

     The following table represents the condition lines added in the JSON viewer in a tabular way. The More Information column describes the conditions added. This table is only meant to help you understand and visualize the JSON conditions in a better way.

     Condition order	Condition bracket	Slot name	Slot operator	Slot value	End bracket	Condition operator	More information
     0	(	mc_ueid	equals	DUMMY	)	AND	Mandatory condition required to identify events; must not be changed.
     1	(	status	not_equals	CLOSED	)	AND	Condition required to enable Orchestration actions on events with the status not equal to Closed; in other words open events.
     2	(	mc_object_class	equals	NUK_Memory	)	AND	Represents a new condition line. Indicates that the Orchestration action will be restricted to events with the mc_object_class slot value equals NUK_Memory. In other words, the Orchestration action is restricted to memory-related events on the Linux platform.
     3	(	mc_parameter_value	greater_than	75	)	AND	Represents a new condition line. Indicates that the Orchestration action is restricted to events with the mc_parameter_value slot value greater than 75. In other words, the Orchestration action will be restricted to events with the memory parameter value greater than 75 (%).

  5. On the JSON viewer, verify if the new condition line is displayed correctly after the first two filter conditions. 
     The following image is an example of how the new condition line might look on the JSON viewer.
     
     In the preceding image, the following definitions apply:
     
     1. Displays the custom use case action ID used for creating the Orchestration action.
     2. Displays the event class used for creating the Orchestration action, in this case the value is ALARM.
     3. Indicates the mandatory filter conditions used for identifying the event. The parameters in this filter condition must not be modified.
     4. Indicates the events that are not closed (in other words, open events). This is a basic filter condition which must be included for a custom Orchestration action. 
     5. Indicates that the Orchestration action is restricted to memory-related events on the Linux platform.
     6. Indicates that the Orchestration action is restricted to events with the memory parameter value greater than 75 (%).
  6. After verifying the new conditions on the JSON viewer, copy all the text from the JSON viewer into the aoActionsContextConditions.json file and save the file. 
  7. On the TrueSight console, verify if the custom Orchestration action is correctly displayed as per the conditions specified.

•  If you are using version 11.3.03 of Presentation Server

  See Creating an Orchestration policy.

High-level process involved when you initiate this Orchestration action

When you initiate the Show Top 10 Memory Processes custom Orchestration action, the TrueSight Orchestration Process Event workflow is run and the following steps are performed.

1. TrueSight Orchestration performs triage to determine whether the event is valid.

2. After a successful triage, TrueSight Orchestration checks the top 10 processes that are consuming the maximum memory. 

3. TrueSight Orchestration updates the event (from which the Orchestration was run) with the details of the top 10 processes in the Output section.

The IT operator assigned to the event must ensure that sufficient memory is available on the affected computer.

After you run the Orchestration action, you can track the status of the action by looking at:

• Related events: At every step, related events are are logged in relation to the main event from which the Orchestration action was run. These events are displayed in the Event Details page as remote action results. To view remote action results, from the event action menu, select View Remote Action Results. Alternatively, click the icon displayed in the event message or on the event toolbar.
• Informational events: At every step, an Information event indicating the status is sent to the TrueSight console.

• Informational events: At every step, an Information event indicating the status is sent to the TrueSight console. You can view these events by selecting the Information quick filter at the top of the page.

Related events indicating the status (under the Remote Action Result tab)

Notice the details of the top 10 processes in the Output section. You can copy these details to a text file for a better viewing experience.