Adding event rules


By default, the health score for an impacted service is computed based on the events generated from all the CIs that are part of the service. However, as a service designer, you can define event rules to consider only specific events based on the impacted CIs, event severities, or messages. 

For example, you can define a rule to compute the service health score to include only events with Critical and Major severities, which will exclude any other type of severities such as Minor or Warning. Currently, you can add a maximum of two rules for a service. 

To add an event rule

  1. Click Services and then click Create New Service
  2. Provide a service definition for a service.
    For more information, see Defining-a-service
  3. Click Events and then click the service (for example, Billing & Payment) for which you want to add the event rule.
  4. In the Define Event Service processing pane, click Add Event Rule.
    1. Enter a rule name.
    2. To be able to select events for health score computation, click Add Filter and select an attribute, operator, and value from the following available options:

      Attribute

      Operator

      Value

      Host

      Equals


      Enter a host name (case sensitive) for which you want to create this rule. 

      Matches

      Enter a host name in a regex expression format.

      Note: Only asterisk * and period . wildcard characters are supported.  

      Examples:

      • hostname.abc: Host name contains hostname.abc
      • hostname.abc.*: Host name starts with hostname.abc
      • .*hostname.abc: Host name ends with hostname.abc
      • hostname.*com: Host name starts with the term hostname and ends with com

      Message

      Equals

      Enter an event message (case sensitive).

      Matches

      Specify a value in a regex expression format. 

      Note: Only asterisk * and period . wildcard characters are supported.  

      Examples:

      • alarm: Message contains alarm 
      • alarm.*: Message starts with alarm
      • .*alarm: Message ends with the term alarm
      • alarm.*memory: Message starts with the term alarm  and ends with memory

      Severity



      Select a severity level.

    3. Click Add.
    4. (Optional) To add more filters, click Add Filter.
      You can add each attribute only once in a rule. For example, after you add Severity as a filter, you can only add Host and Message attributes in the rule.
      In the following example, rules are specified to consider all critical events on all hosts that start with host-aus.
      Event Rules Example 23.2.02.png
  5. Click Save and Close.
  6. To add another rule, click Add Event Rule
    You can only add up to two rules for a service. 
  1. Click Save and Close.
    The count of event rules is shown as part of the Billing & Payment service.
    AddEventRules_23202.png


To edit an event rule

  1. Click Services and then click a service name for which you want to edit event rules.
  2. From the action menu action_menu.png, select Edit Service
  3. On the Edit Service page, click Events and select a service.
  4. In the Define Event Service processing pane, click the Action menu for an event rule, and select Edit.
  5. Edit the rule as required.

    Important

    If you add any CIs, the health score computation for the newly added CIs begins 15 minutes after the service is updated. 

  6. Click Save and Close.


To delete an event rule

If you delete event rules, all events impacting a service are considered for computing the health score. 

  1. Click Services and then click a service name for which you want to delete the rule. 
  2. From the action menuaction_menu.png, select Edit Service.
  3. On the Edit Service page, click Events and then click a service that has rules. 
    The Define Event Service processing pane shows the rules defined for the service.
  4. From the Action menu for the rule, click Delete
  5. Click Save and Close.


Where to go from here

Based on what you want to configure for your services, perform the following optional tasks:

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*