Creating automation policies

Automation policies execute actions that remediate issues identified by the events generated in BMC Helix Operations Management or BMC Helix AIOps. 

As an automation engineer, you can create automation policies for frequently occurring issues such as service down or disk space utilization or based on incoming requests for automation. A policy can be triggered automatically (when an event matches the trigger condition specified in the policy), or manually, (as automation actions in BMC Helix Operations Management or BMC Helix AIOps). 

Automation policies contain one or more actions that connect with the automation applications supported by BMC Helix Intelligent Automation to perform remediation actions for events. 

Related topics

Viewing-automation-requests


The following video (3:33) by BMC Support team describes how to create an automation policy by using an example of the Generic REST API connector: 

icon_play.png Watch the YouTube video about How to create an automation policy


To create an automation policy

Perform the following steps to create an automation policy:

Step 1: To provide the policy information and specify the execution mode

  1. On the BMC Helix Intelligent Automation console, click Policies.
  2. Click Create Automation Policy.
  3. In the Policy Information section, type a unique name and an optional description for the policy. 

  4. Select the execution mode as Manual or Automatic.

    Can I change the execution mode later?

    Yes, you can edit the policy and change the mode anytime. By default, manual execution is selected. 

Create policy step 1.png


Step 2: To define the trigger condition to match the incoming event

  1. In the Trigger section, click Browse, and do one of the following:

    • From the Select Event Type tab, select an existing event type and click Done.
      The trigger condition from the event is listed in the following format: <eventCategory>: <eventName>.

      Important

      Where do these event types come from?

       listens to all incoming events from  and stores unique event schemas. Based on these schemas, the event types are listed here. 

      Why don't I see some of the existing event types to choose from? 

       uses a randomized sampling algorithm to store a subset of the values for an event type. This store is designed to facilitate selection while creating the policy trigger condition based on the sample data. It may take some time for the event types to get updated.   

    • On the Paste Event JSON tab, type the event information in the JSON format, and click Done.

    When you select an event, all parameters in the event appear in the right pane. 

  2. (Optional; applicable only for automatic policies) To prevent the automation policy from running when an event is updated, select the Exclude event updates check box.
    If selected, the automation policy does not run when the event is updated. 
    Exclude event updates_24301.png

    Important

    By default, this configuration is applicable for policies that run in an automatic execution mode. However, if you still want to trigger the automation manually for any event updates, the policy runs successfully.

  3. Click anywhere in the Trigger Condition box to start building the expression for a trigger condition, and use the suggested parameters, values, and operators to complete the expression.
    For sample expressions, see Trigger condition expression. 

Exclude event updates_24301.gif


Step 3: To select actions to be run as part of the policy

  1. To add action to the policy, click Add Action and perform the following steps:
    1. From the Pick an automation tool section, click the connector name.
      Only configured connectors are displayed here. The wizard takes you to the next step to select an action. 
    2. Click Sync Actions.
      All actions available in the selected connector appear. 
    3. Click Select against the action that you want to add to the policy.
      The wizard takes you to the next step to configure an action.

    4. Depending on the selected action, provide the information and click Done.

      Important

      Based on the selected event, the event slots with the values specified in the event appear under the Parameters section on the UI. You can click any of the parameters and its value gets copied. You can paste it while defining the action in the policy. 

      The added action appears in the Action Configuration section. You can add multiple actions in a policy. 

      Adding action for supported applications

      To add an action for a specific automation application, see the following documentation for an example of each of the supported connections:

ActionWizardGif4.gif


Step 4: To add tags

  1. To add system or custom tags to the policy, perform the following steps:
    1. System tags: Select one or more tags from the list of available system tags. 
      System tags are displayed based on the selected event data. 
    2. Custom tags: In the Tags (Optional) section, specify a key-value pair. 
      The tag key should start with an alphabet and end with an alphanumeric character. Supported characters are alphanumeric characters and periods, dashes, and underscores. 

Custom tags.png


Step 5: To configure change management for creating change requests

To create a change request as part of this policy, perform the following steps:

  1. If not enabled already, use the Enable change ticket creation toggle key and then click Modify to add change request values. 
  2. Select the appropriate values for the following fields:
    1. Impact
    2. Urgency
    3. Company
    4. First Name: By default, the first and last name of the logged-in user is displayed. 
      When you type the first name, based on the selected company, the list of user names belonging to that company is displayed in the <username-firstname-lastname> format. If there are multiple users with the same first name, you can select the correct user from the list. When you select the first name, the last name gets selected. 
      Select First Name Last Name.gif
    5. Last Name

    6. Description: By default, contains the name of the product, BMC Helix Intelligent Automation.
      The description is updated in the Summary field in the change request in BMC Helix ITSM. Ensure that the description is up to 100 characters only. 
      The selected values are displayed. When a change is created in BMC Helix ITSM, it will contain the values specified in the policy.

      ITSM FirstName Selection.png

      Important

      If the user credentials for the  get changed for the tenant, it takes 15 minutes to reflect the changes in BMC Helix Intelligent Automation. In this time period, if the the policies with change management options are triggered, they fail and display an authentication failed error. After 15 minutes, if the policies are triggered again, they will successfully run.   

      After the change request is approved in , the policy is triggered and runs the actions. 

    7. Click Save. 

Step 6: To provide estimated savings

  1. In the Estimated Savings section, typean approximate time (in minutes) and money (in USD) that you may save by automating the actions. 
  2. Continue to the next step.


Estimated Savings.png

Step 7: To configure notifications and publish the policy

By default, the Generate Information Event on execution check box is selected. Every time this policy runs, an information event (AUTOMATION_STATUS_EV class) is generated in BMC Helix Operations Management.

Important

  • Do not specify the AUTOMATION_STATUS_EV class in the trigger condition, especially if using the automatic execution mode, because it might create infinite loops of the incident process, thus creating event noise.  
  • Information events are generated for policies that have already been created. If you do not want the information events, edit a policy and clear the check box. 
  • If you clear the check box: 
    • Policy execution is not counted in the Automation Runs count in  Value Dashboard. For more information, see Viewing-policies-in-BMC-Helix-Dashboards.
    • If users run this automation policy from , the status of the policy in  still shows Running even if the policy may have run successfully.  
  • If you do not want to generate information events of the type Automation_Status_EV in  for the out-of-the-box policies created as part of solutions (Blackout Policy or ), then you must configure the solution again. If you configure the solution again, automation status information events are not generated. 

Select Publish Policy and click Save.


UI messages for Notification step w highlights.png


(Optional step) To test the policy

When creating a policy, you can select an event from the list of events that have occurred in BMC Helix Operations Management. BMC Helix Intelligent Automation listens to BMC Helix Operations Management over a period of time and shows a list of event types to make it easy to build policies. For testing, BMC Helix Intelligent Automation uses the event data selected as part of the policy creation process. It does not create a new event, or wait for a new event coming from BMC Helix Operations Management. You can test a policy with the parameters specified in the policy or update the parameter values to test a policy. 

Note

Changing the trigger conditions to test a policy may cause the policy to fail during testing if the new conditions don't match the stored event type. For example, if you select a "Service Down" event to create a policy,  uses a "Service Down" event stored in the product. If you change the trigger conditions, the test may fail if they don't match the stored event.


  1. Click Test Policy.
    You are prompted to save the policy. 
  2. Click Confirm.
    On the Test Inputs tab, a list of event parameters is shown. You can select one or multiple parameters and update the value for the parameters to test the policy. 
    Test Policy with data 23302.png

  1. Click Execute. 
    The results appear in the Test Results tab. The values updated while testing the policy are not saved as trigger conditions, and the event JSON also does not get updated in the actual policy. 

    Can I test a policy later?

    Yes, however, you need to change a policy status to draft and edit the policy to test it. BMC recommends that you test a policy while creating it.

Trigger condition expression

To build a trigger condition expression, you can use the expression builder provided by BMC Helix Intelligent Automation  while creating an automation policy. To learn more, see Trigger condition. 

The following table lists sample conditions and the events that will match to those conditions:

Scenario

Trigger condition example

Description

Sample event

Service is down

( $.event.msg == 'SERVICES_Spooler Service status == 3 0 - Running, 1 - Ok not running, 2 - Warning not running, 3 - Alarm not running for 1 min.' ) && ( $.event.source_hostname == 'vw-host.com' ) && ( $.event.class like_regex '^.*ALARM.*$' )

Matches any event where msg equals SERVICES_Spooler Service status == 3 0 - Running, 1 - Ok not running, 2 - Warning not running, 3 - Alarm not running for 1 min. and source_hostname equals the hostname specified in the condition, and the class contains ALARM.

Click here to view a sample Windows Service Down event
{
   "msg": "SERVICES_Spooler Service status == 3 0 - Running, 1 - Ok not running, 2 - Warning not running, 3 - Alarm not running for 1 min.",
   "creation_time": 1598887988000,
   "_tenant_id": "1602985772",
   "incident_type": "",
   "al_baseline_weekly_low": "",
   "al_parameter_value": "3.0",
   "al_thresh_id": "NT_SERVICES:ServiceStatus:CRITICAL:1602985772:ALL",
   "modelname": "",
   "incident_operational_category1": "",
   "incident_operational_category2": "",
   "incident_operational_category3": "",
   "al_parameter_unit": "0 - Running, 1 - Ok not running, 2 - Warning not running, 3 - Alarm not running",
   "source_identifier": "bcc31a2d-****-****-****-ad4880bc2f71",
   "al_thresh_type": "USERDEFINED",
   "incident_id": "",
   "_service_id": "",
   "_operations": "[0x1744526ba09,admin,TSO CDP Service Down,Alarm (ALL),'']",
   "incident_company": "",
   "al_parameter_threshold": "3.0",
   "al_baseline_hourly_high": "",
   "details": "",
   "_modified_time": 1598888000442,
   "_notes": "[]",
   "al_event_score": "0",
   "al_avg_value": "",
   "al_old_severity": "UNKNOWN",
   "al_is_predicted": "FALSE",
   "al_alarm_id": "bcc31a2d-774e-4efe-99ec-ad4880bc2f71",
   "al_end_time": 4294967295000,
   "al_parameter_name": "ServiceStatus",
   "incident_category": "",
   "al_extremeness": 0,
   "priority": "PRIORITY_5",
   "object_id": "d7677983-953d-4554-88ee-168c1187891d:NT_SERVICES:SERVICES_Spooler",
   "al_thresh_above": "TRUE",
   "_node_id": "",
   "_identifier": "bcc31a2d-774e-4efe-99ec-ad4880bc2f71",
   "tags": "[]",
   "instancename": "",
   "_repeat_count": "0",
   "user_assigned": "",
   "componentalias": "",
   "al_pts_exceeded": "0",
   "al_baseline_daily_low": "",
   "al_highest_severity": "CRITICAL",
   "status": "OPEN",
   "object": "SERVICES_Spooler",
   "al_pts_total": "0",
   "sub_category": "OTHER",
   "al_baseline_daily_high": "",
   "al_last_time": "0",
   "_errors": "[]",
   "al_baseline_weekly_high": "",
   "_ci_id": "74ba8fda-fbf9-4f3b-a63b-decf23d5b776",
   "al_baseline_hourly_low": "",
   "source_address": "10.128.190.230",
   "source_port": "0",
   "cross_launch_uri": "",
   "alias": [
       "BMC_ComputerSystem:vw-pun-bao-pt01"
    ],
   "al_device_ipaddress": "176620902",
   "class": "ALARM",
   "object_class": "NT_SERVICES",
   "_lifecycle_time": "0",
   "severity": "CRITICAL",
   "al_thresh_duration": 60,
   "incident_item": "",
   "_arrival_time": 1598888000442,
   "al_prediction_severity": "UNKNOWN",
   "cdmclass": "",
   "al_agent_os": "Windows Server 2012 R2 Standard",
   "_unmapped_data": {
       "al_baseline_type": null
    },
   "al_agent_name": "vw-pun-bao-pt01",
   "al_predict_to_occur_time": "0",
   "al_agent_port": "3181",
   "_model": "",
   "location": "",
   "category": "OPERATIONS_MANAGEMENT",
  "source_hostname": "vw-pun-bao-pt01.bmc.com"
}

Overallocated containers

( $.event.tags.platform like_regex '^.*kubernetes.*$' ) && ( $.event.payload.resources[*].cluster like_regex '^.*vmcluster.*$' ) && ( $.event.payload.resources[*].namespace == 'adeint' )

Matches any event where the tags.platform contains kubernetes, payload.resources[*].cluster contains the name of the cluster and the payload.resources[*].namespace equals adeint.

Click here to view an overallocated container event
{
   "tags": {
       "event_type": "OVERALLOCATED_CONTAINER_RECOMMENDATION_REMOTE_PLUGIN",
       "platform": "kubernetes"
   },
   "payload": {
       "generated_by": {
           "product": "Optimize",
           "version": "21.05.00"
       },
       "resources": [
           {
               "resource_id": "?",
               "resource_name": "ade-reporting",
               "account_id": "?",
               "account_name": "?",
               "cluster": "aus-k8s-vmcluster",
               "namespace": "host1",
               "deployment": "adereporting",
               "current_cpu_request": 500,
               "current_cpu_limit": 1000,
               "current_memory_request": 2560,
               "current_memory_limit": 2560,
               "cpu_demand": 25,
               "cpu_demand_peak": 350,
               "memory_demand": 2227,
               "memory_demand_peak": 2227,     
               "tags": {
                   "Environment": [
                       "Trial"
                    ],
                   "Department": [
                       "Sales"
                    ]
               },
               "container_cpu_recommendation": {
                   "action": "reduce_cpu_allocation",
                   "recommended_cpu_request": "200m",
                   "reclaimable_cpu": 450,
                   "recommended_cpu_limit": "500m"
               },
                       "container_memory_recommendation": {
                   "action": "reduce_memory_allocation",
                   "recommended_memory_request": "128Mi",
                   "reclaimable_memory": 450,
                   "recommended_memory_limit": "1Gi"
               }
           }
        ]
   }
}

Stop an Amazon EC2 instance

$.event.event_type like_regex '^.*ec2_stop.*$' && $.event.region_code == 'us-east-1'

Matches any event where the event_type field contains ec2_stop and the region_code is us-east-1.

Sample event for AWS EC2 instance
{
   "event_type": "aws-ec2_stop",
   "region_code": "us-east-1",
  "resource_id": "i-07a07b95f94e69673"
}






Where to go from here

After successfully creating policies, you can view the automation policies in the console, see Viewing-editing-and-copying-automation-policies. 

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*