Example of configurations required for a custom use case

Scenario: Suppose you see the following event on the TrueSight console indicating that more than 75% memory is getting utilized on a particular computer.

You want to perform triage to see the top 10 processes that are consuming the maximum memory on the affected computer.

Before you begin

Ensure that the requirements for TrueSight Orchestration and requirements for Presentation Server are already met.

 Presentation Server requirements

To be able to initiate Orchestration actions from events, ensure that the following requirements are already met:

#Requirement
1

On Administration > Components, add a TrueSight Orchestration component and a TrueSight Infrastructure Management component.

For more information, see Adding and editing components.

Notes:

  • Ensure that the user that you provide for the integration is part of the AoAdmin group on Remedy Single Sign-On.
  • Ensure that TrueSight Orchestration Platform 8.2.00 and later is already installed and the same details are given while registering the component.
2On the Administration > Components page, ensure that the TrueSight Orchestration component status is Connected.
3

Ensure that you have the permission to view and initiate Orchestration actions from events. This permission is governed by the Allow Orchestrator Actions permission on the Roles page.

4If you plan to use BMC Service Resolution for incident management, ensure that Presentation Server 11.3.02 is integrated with BMC Service Resolution.


 TrueSight Orchestration requirements

To be able to initiate Orchestration actions from events, ensure that the following requirements are already met:

#Requirement
1

Ensure that TrueSight Orchestration Platform version 8.2 or later is already installed.

For more information, see Installing the TrueSight Orchestration Platform.

2

Ensure that Event Orchestration runbook version 20.19.01 is already installed on the TrueSight Orchestration Platform.

You can choose to configure content either during the installation or after the installation manually.

  • For information about installing the Event Orchestration runbook, see Installing the Event Orchestration runbook.
  • For information about configuring content post installation manually, see Configuring content in the Event Orchestration runbook.
3Ensure that TrueSight Orchestration is already integrated with BMC Remedy IT Service Management for performing the change management process.

Configure the custom use case for the example scenario on TrueSight Orchestration

On TrueSight Orchestration, create a custom use case for getting details of the top 10 processes that are consuming the maximum memory. For more information, see Example of adding a custom use case.

Configure event selection for the example scenario on Presentation Server

Configure event selection to enable the custom Orchestration action on Linux events with the memory parameter value greater than 75%.

This step is optional. If you do not perform this step, the custom Orchestration action will be displayed on all the events irrespective of context. With the result, each time you want to run the custom orchestration action, you need to first analyze the event and ensure that it is correct and relevant to the use case.

To configure event selection, do the following:

  1. Navigate to the %TRUESIGHTPSERVER_HOME%\truesightpserver\conf\ directory and open the aoActionsContextConditions.json file.

    Tip

    Ensure that word wrap is turned on while viewing the aoActionsContextConditions.json file for a better viewing experience.

    Best practice

    Before you make any changes in the aoActionsContextConditions.json file, ensure that you back it up.

  2. Copy all the contents of aoActionsContextConditions.json file in a JSON viewer.

  3. Copy the following lines:

    Example of the new condition lines added for selecting memory events on Linux
    {"condition_order":18,"slot_name":"mc_parameter_value","condition_bracket":"","condition_operator":"AND","slot_operator":"greater_than","slot_value":"1.0","end_bracket":"))"}]}},
    {"aoaction_id":"BMC_TrueSight-MemoryUtilization-1",  "advanceFilter":{"name":"","eventClass":"ALARM","status":"","severity":"","application":"","service":"","groups":"","devices":"","monitors":"","global_filter":0,"filter_type":1,"filterConditions":[{"condition_order":0,"slot_name":"mc_ueid","condition_bracket":"","condition_operator":"AND","slot_operator":"equals","slot_value":"DUMMY","end_bracket":""},{"condition_order":1,"slot_name":"status","condition_bracket":"","condition_operator":"AND","slot_operator":"not_equals","slot_value":"CLOSED","end_bracket":""},{"condition_order":2,"slot_name":"mc_object_class","condition_bracket":"","condition_operator":"AND","slot_operator":"equals","slot_value":"NUK_Memory","end_bracket":""},{"condition_order":3,"slot_name":"mc_parameter_value","condition_bracket":"","condition_operator":"AND","slot_operator":"greater_than","slot_value":"75","end_bracket":""}]}}
  4. In the JSON viewer, add the copied lines at the end of the contents in the following way:

    • Add the copied lines on a new line after the line for "condition_order":18 and before the last two paranthesis.

    • Before the copied lines, ensure that you add a comma separator as shown in the following example.

    Example of the new condition lines added for selecting memory events on Linux
    {"condition_order":18,"slot_name":"mc_parameter_value","condition_bracket":"","condition_operator":"AND","slot_operator":"greater_than","slot_value":"1.0","end_bracket":"))"}]}},
    {"aoaction_id":"BMC_TrueSight-MemoryUtilization-1",  "advanceFilter":{"name":"","eventClass":"ALARM","status":"","severity":"","application":"","service":"","groups":"","devices":"","monitors":"","global_filter":0,"filter_type":1,"filterConditions":[{"condition_order":0,"slot_name":"mc_ueid","condition_bracket":"","condition_operator":"AND","slot_operator":"equals","slot_value":"DUMMY","end_bracket":""},{"condition_order":1,"slot_name":"status","condition_bracket":"","condition_operator":"AND","slot_operator":"not_equals","slot_value":"CLOSED","end_bracket":""},{"condition_order":2,"slot_name":"mc_object_class","condition_bracket":"","condition_operator":"AND","slot_operator":"equals","slot_value":"NUK_Memory","end_bracket":""},{"condition_order":3,"slot_name":"mc_parameter_value","condition_bracket":"","condition_operator":"AND","slot_operator":"greater_than","slot_value":"75","end_bracket":""}]}}

    Notice the AO action ID is set to BMC_TrueSight-MemoryUtilization-1 and the event class is set to ALARM

    The following table represents the condition lines added in the JSON viewer in a tabular way. The More Information column describes the conditions added. This table is only meant to help you understand and visualize the JSON conditions in a better way.

    Condition orderCondition bracketSlot nameSlot operatorSlot valueEnd bracketCondition operatorMore information
    0(

    mc_ueid

    equalsDUMMY)AND (plus)Mandatory condition required to identify events; must not be changed.
    1(statusnot_equalsCLOSED)AND (plus)Condition required to enable Orchestration actions on events with the status not equal to Closed; in other words open events.
    2(mc_object_classequalsNUK_Memory)AND (plus)Represents a new condition line. Indicates that the Orchestration action will be restricted to events with the mc_object_class slot value equals NUK_Memory. In other words, the Orchestration action is restricted to memory-related events on the Linux platform.
    3(mc_parameter_valuegreater_than75)AND (plus)Represents a new condition line. Indicates that the Orchestration action is restricted to events with the mc_parameter_value slot value greater than 75. In other words, the Orchestration action will be restricted to events with the memory parameter value greater than 75 (%).

  5. On the JSON viewer, verify if the new condition line is displayed correctly after the first two filter conditions. 
    The following image is an example of how the new condition line might look on the JSON viewer.

    In the preceding image, the following definitions apply:
    1. Displays the custom use case action ID used for creating the Orchestration action.
    2. Displays the event class used for creating the Orchestration action, in this case the value is ALARM.
    3. Indicates the mandatory filter conditions used for identifying the event. The parameters in this filter condition must not be modified.
    4. Indicates the events that are not closed (in other words, open events). This is a basic filter condition which must be included for a custom Orchestration action. 
    5. Indicates that the Orchestration action is restricted to memory-related events on the Linux platform.
    6. Indicates that the Orchestration action is restricted to events with the memory parameter value greater than 75 (%).
  6. After verifying the new conditions on the JSON viewer, copy all the text from the JSON viewer into the aoActionsContextConditions.json file and save the file. 
  7. On the TrueSight console, verify if the custom Orchestration action is correctly displayed as per the conditions specified.

You need to perform the following configuration tasks to create a custom use case and enable the custom Orchestration action on relevant events:

High-level process involved when you initiate this Orchestration action

When you initiate the Show Top 10 Memory Processes custom Orchestration action, the TrueSight Orchestration Process Event workflow is run and the following steps are performed.

  1. TrueSight Orchestration performs triage to determine whether the event is valid.

  2. After a successful triage, TrueSight Orchestration checks the top 10 processes that are consuming the maximum memory. 
  3. TrueSight Orchestration updates the event (from which the Orchestration was run) with the details of the top 10 processes in the Output section.

The IT operator assigned to the event must ensure that sufficient memory is available on the affected computer.

After you run the Orchestration action, you can track the status of the action by looking at:

  • Related events: At every step, related events are are logged in relation to the main event from which the Orchestration action was run. These events are displayed in the Event Details page as remote action results. To view remote action results, from the event action menu, select View Remote Action Results. Alternatively, click the icon displayed in the event message or on the event toolbar.
  • Informational events: At every step, an Information event indicating the status is sent to the TrueSight console.
  • Informational events: At every step, an Information event indicating the status is sent to the TrueSight console. You can view these events by selecting the Information quick filter at the top of the page.

Related events indicating the status (under the Remote Action Result tab)

Notice the details of the top 10 processes in the Output section. You can copy these details to a text file for a better viewing experience.

Was this page helpful? Yes No Submitting... Thank you

Comments

  1. Deepak Kamath

    The event size in truesight increases adding additional text data. Is there a way to display the output without adding in event notes field ?

    Sep 17, 2019 07:27