Using Orchestration actions to enable triage and remediation of events

TrueSight Orchestration enables you to automate known remediation scenarios. So, when an event occurs on the TrueSight console, you can easily initiate an Orchestration action from that event. If the Orchestration action is successfully initiated, the remediation steps are run.

Incoming events displayed on the Monitoring > Events page can be of many types. Some events are important and actionable, others are informational, and still others contribute noise. Some of the important and actionable events are recurring events with known remediation steps. Such events can be remediated quickly and easily by running Orchestration actions to reduce time, errors, and delays associated with manual methods. You can also run Orchestration actions to perform triage activities only. By default, TrueSight Presentation Server uses predefined context-based event selection to display out-of-the-box Orchestration actions for relevant events only. 

Note that Orchestration actions can be run for PATROL events and alarm events only. To be able to access the Orchestration actions, Presentation Server must be integrated with TrueSight Orchestration and a set of prerequisites must be met on both Presentation Server and TrueSight Orchestration.

If you want to remediate events for use cases other than the ones covered by the out-of-the-box Orchestration actions, you need to configure custom Orchestration actions. 

• • End-to-end process overview
  • Requirements for Presentation Server
  • Requirements for TrueSight Orchestration
  • Out-of-the-box Orchestration policies
  • To initiate an Orchestration action from an event
  • Examples of out-of-the-box Orchestration actions
  • Configuring custom Orchestration actions

End-to-end process overview

The following image depicts the end-to-end process involved when you initiate an Orchestration action.

The process starts when an IT operator on the TrueSight console launches an Orchestration action for a particular event. Event data is sent to TrueSight Orchestration. Based on the use case, a triage action is triggered, which verifies the validity of the event. Note that based on the use case triage may not always be required.

Next, an incident is created. By default, BMC Service Resolution is configured to perform incident management. However, you can manually configure TrueSight Orchestration to perform incident management. To configure TrueSight Orchestration for incident management, you need to change some settings on TrueSight Orchestration, in the BMC-SA-Event_Orchestration_Configuration module configuration, under the Specifics > BMC_TrueSight configuration group. For more information, see Configuring modules in the Event Orchestration runbook.

Then, a change request is created and the workflow waits for the change to be approved. By default, change management is already enabled through TrueSight Orchestration. Note that both change and incident management may not be required based on the use case for which you want to initiate an Orchestration action.

If the remediation action is defined, the remediation action is run, which performs the corrective action on the target server where the problem has occurred. After the remediation is complete, the validation actions are run to ensure that remediation is successful. If a change request was created earlier, it is updated with the latest status and the incident is resolved. Furthermore, TrueSight Infrastructure Management detects that the condition has returned to normal and subsequently closes the event.

Each step of this orchestration process is configurable, such as whether to perform a triage only action, or a combination of triage and remediation or only remediation, and so on. TrueSight Presentation Server provides you with out-of-the box Orchestration actions to perform triage and remediation for service down use case and only triage for the host down use case. If you want to run Orchestration actions for any other use case, you need to perform a set of configurations on TrueSight Orchestration. For more information, see Configuring Orchestration actions for custom use cases.

At each stage of the process, related events are associated with the event from which the Orchestration action was run and are displayed under the Remote Action Result tab. 

Requirements for Presentation Server

To be able to initiate Orchestration actions from events, ensure that the following requirements are already met:

Requirements for TrueSight Orchestration

To be able to initiate Orchestration actions from events, ensure that the following requirements are already met:

Out-of-the-box Orchestration policies

The following table lists the supported out-of-the-box Orchestration policies. You can use these policies to initiate Orchestration actions for different types of use cases.

These policies are editable and can be customized as per your needs.

For more information about each of the use cases, see Orchestration actions.

To initiate an Orchestration action from an event

An Orchestration action can be initiated for one event at a time.

1. Go to the Monitoring > Events page.
2. Click the action menu of the desired event and select Launch Orchestration Actions.
3. Select an Orchestration action from the list displayed, and then click Launch.
   A status message indicating whether the action initiation was successful is displayed at the top of the page.

Examples of out-of-the-box Orchestration actions

The following examples describe the high-level process involved when you run one of the out-of-the-box Orchestration actions.

High-level process flow for the service down use case

High-level process flow for the host down use case

Configuring custom Orchestration actions

If you want to initiate Orchestration actions for use cases other than the out-of-box use cases, then you need to perform additional configurations.

The following table summarizes the configuration steps required for configuring a custom Orchestration action and enabling it on relevant events.