This documentation supports an earlier version of BMC Helix Operations Management.To view the documentation for the latest version, select 23.1 from the Product version picker.

Example: Enrich events according to the device status

Scenario

Sarah is an administrator at Apex Global. She has been using out-of-the-box enumerations for defining Enum data type event slots for managing events. Her company uses a custom list of values for the device status and these values are not supported by the out-of-the-box enumerations in BMC Helix Operations Management. She wants to use the following list of values for the device status and enrich the severity, owner, and detailed message in the event based on these values:

  • Up
  • Down
  • Administratively down

Before you begin, make sure to create the custom enumeration and specify it as an attribute of the event class. For more information, see the following topics:

To enrich the event severity, owner, and detailed message, perform the following steps:

  1. Define the event selection criteria.
  2. Build the policy workflow.

Actions used in the example

  • If
  • Enrich

For more information about actions, see Actions for advanced and time-based enrichment.

To define the event selection criteria

  1. Select Configuration > Event Policies and click Create.
  2. In the Event Selection Criteria, define a condition to select events from the class NAGIOS2_EV.

The following image illustrates how the event selection criteria will look:

Event_selection_criteria_custom_enum.png

To learn how to construct the event selection criteria, see Creating and enabling event policies.

To build the policy workflow

On the Advanced Enrichment page, perform the following steps to build the policy workflow:
Failed to execute the [excerpt-include] macro. Cause: [Error number 2 in 0: No wiki with id [confluencePage:page] could be found]. Click on this message for details.

  1. Add the If action to check the status of the device. Assume that the custom enumeration device status has the following list of values:
    Device_status_enum.pngIf_condition_custom_enum.png

  2. If the device is down, in the Then part, add the Enrich action to enrich the event severity to critical.
    Enrich_function_enrich_severity_custom_enum.png

  3. Add the Enrich action to assign an owner for the event.
    Enrich_function_assign_owner_custom_enum.png

  4. In the Else part, add the If action to check the status of the device.If_condition_device_up_custom_enum.png

  5. If the device is up, add the Enrich action to enrich the detailed message in the event.
    Else_enrich_detailed_message_custom_enum.png

Results

The policy workflow enriches the severity, owner, and detailed message in the event as shown in the following images:

Enriched_event1_custom_enum.png

Enriched_event2_custom_enum.png

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*