Default language.

Troubleshooting policy issues

This topic lists troubleshooting information for policies.


Unable to delete a dynamic enrichment policy

Symptom

On the Event Policies page, you are unable to delete a dynamic enrichment policy (DEP) that you created by using the Copy option.

Scope

This issue occurs under the following situations:

  • You create more than two copies of a DEP policy by using the Copy option.
  • You attempt to delete any policy instance beyond two, for example a third policy instance.

Workaround

As a workaround for this issue, perform the following steps:

  1. On the Event Policies page, edit the policy that you want to delete.

  2. In Policy Configuration, delete the dynamic enrichment configuration from the policy.

    Important

    If the policy has only one configuration and that is the dynamic enrichment configuration, add another policy configuration before you delete the dynamic enrichment configuration.

  3. Click Save.
  4. Select the policy that you updated and click Delete.


Unable to import event policies

Symptom

On the Event Policies page, you are unable to import an event policy.

Scope

This issue occurs under the following situations:

  • You import a policy json file into a tenant that is exported from a  version earlier than 23.2.02.
  • The structure of the policy json file that you import does not match the json file structure of   version 23.2.02.

Workaround

Make sure that the json file you import matches, for example, the following file structure:

Policy file structure
{
 "policyList": [
   {
     "name": "Dynamic enrichment policy",
     "types": [
       "ADVANCED_ENRICHMENT"
      ],
     "description": "",
     "executionOrder": 9999,
     "selectorCriteriaList": [
       "( class equals 'ALARM' )"
      ],
     "enabled": false,
     "configurations": [
       {
         "type": "ADVANCED_ENRICHMENT",
         "configOrder": 1,
         "definition": {
           "children": [
             {
               "skipDDEEnrichEvaluation": false,
               "fieldSeparator": ",",
               "matchFields": [
                 "severity",
                 "priority"
                ],
               "matchTableID": "39aedd54-fb18-11eb-ad35-f730820138e4",
               "enrichFields": [
                 "msg"
                ],
               "type": "dynamicDataEnrichment",
               "matchPreference": "First",
               "matchTableCount": "6",
               "labels": {
                 "matchFields": "Match Field",
                 "enrichFields": "Enrich Field",
                 "importData": "Import setting label"
               }
             }
            ],
           "label": "null",
           "type": "root"
         },
         "timeframeStatus": "",
         "subType": "DYNAMIC_ENRICHMENT"
       }
      ],
     "timeframes": [
       "-1"
      ]
   }
  ],
 "dataTablesMap": [
   {
     "Dynamic enrichment policy.1": {
       "presentMatchTableId": "39aedd54-fb18-11eb-ad35-f730820138e4",
       "tag": "1",
       "matchTableContent": "*ITICAL,PRIORITY_3,NotEnrichedWhenBestMatch\nCRITICAL,PRIORITY_2,CRITICAL_HIGH_Event_Enriched\nMAJ*,PRIORITY_*,NotEnrichedWhenBestMatchWhenNextRowHasMAJOR_INFO\n*OR,PRIORITY_5,MinorEventEnrichedAsNoOtherMF_For_Minor\n*INFO,PRIORITY_5,InfoEnrichedForOpenInfoEvents\nMAJOR,PRIORITY_5,majorInfoEventEnrichedBestMatch"
     }
   }
  ]
}

The imported policy json file structure must have the policyList and dataTablesMap attributes. For event policies other than dynamic enrichment policies, the dataTablesMap attribute is an empty array.


Unable to create or update a blackout policy

Symptom

You cannot create or update a blackout policy.

Scope

A blackout policy is not created or updated if both of the following conditions are met:

  • You select one of the following options:
    • Blackout existing events
    • Restore the last status of blacked-out events
  • The Matches or other conditions exceed their maximum limit.

Workaround

Make sure that the value entered in the Matches or other operators does not exceed its maximum limit. The maximum limit for the Matches operator is 1,000 characters. The maximum limit for other operators depends on the conditions used in the Event Selection Criteria field. If any operator value goes beyond the maximum limit, the blackout policy is not created or updated.

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*