Closing events automatically

According to your license agreement, open events are closed 90 days after the last modification date. For more information, see BMC Helix Operations Management service. Use event policies to automatically close the events earlier. 

The following are a few scenarios that show how you can close events automatically:

• Create a time-based event policy to close the events that have not been modified in the last 24 hours.
• Create a time-based event policy to close the events if the event severity is INFO or OK.
• Create an advanced enrichment event policy to close the temporary or custom events that are generated to invoke an event policy.

We will learn the steps to close events automatically by using a time-based event policy if an event has not been modified in the last 24 hours. For this purpose, we will add the following variables and actions to a time-based policy workflow:

• Timeout action
• Variables
  • To store the current time
  • To store the last modified time of the event
  • To store the time difference between the current and last modified time
• If action to verify whether the last modified time is greater than 24 hours
• Enrich action to close the event

For more information about advanced and time-based enrichment of event policies, see Actions-for-advanced-and-time-based-enrichment.

Task 1: Add a Timeout action

1. From the Policy Configuration field, select Time Based.
2. Click Timeout.
3. Enter a label; for example, Timeout.
4. Enter 24 as value and select Hours as the unit.
5. Click Apply.

Task 2: Add variables

1. Add a variable to store the current time:
   1. Click Add below and select Variable.
   2. In the Label and Name fields, enter a label and name for the variable; for example, CurrentTime.
   3. In the Value field, click Function, select CurrentTimeStamp as the function, and click Apply.
2. Add another variable to store the last event modified time:
   1. Click Add below and select Variable.
   2. In the Label and Name fields, enter a label and name for the variable; for example, ModifiedTime.
   3. In the Value field, click Event Slot, select Modified as the slot, and click Apply.
3. Add the variable to store the time difference:
   1. Click Add below and select Variable.
   2. In the Label and Name fields, enter a label and name for the variable; for example, TimeDifference.
   3. In the Value field, click Function, and select the function as Math.
   4. Select Minus as Operator, $CurrentTime as Number 1, and $ModifiedTime as Number 2.
   5. Click Apply.

Task 3: Add if action

1. Click Add below and select If.
2. In the Label field, enter a label; for example, TimeDifference is greater than 24 hours.
3. In the If field, enter ( $TimeDifference Greater than 86,400 ).
   Ensure that you convert hours into seconds.
4. Click Apply.

Task 4: Add enrich action to close the event

1. Click Add below and select Enrich.
2. In the Label field, enter a label; for example, ChangeEventStatus.
3. From the Slot to Enrich list, select Status.
4. From the Value list, select Closed.
5. Click Apply.
6. Click Save.
7. Select the Enable Policy check box.
8. Click Save.

The following image shows these time-based configurations in an event policy: