Enabling filtering and Rule Set match rate for Rule Sets
Confirm Rule Set Filter Modification panel
COMMAND ===> TGT --- RB65
+----------------------------------------------------------------------------+
+ WARNING! Changes were made to the Filter in the RULNET5 Rule Set. Those +
+ changes were one or more of the following: +
+ +
+ o Field(s) within the Rule Set Filter were modified. +
+ o All field(s) within the Rule Set Filter where cleared. +
+ +
+ Please enter one of the following: +
+ - SAVE to save RULNET5 in SYS2 BAORMB.RB71.UBBPARM +
+ - SAVECUR to save RULNET5 in SYS2.PRODUCT.BMC.SJSD.BBPARM +
+ - SAVEIN to select a dataset to save RULNET5 +
+ - NOSAVE to exit WITHOUT saving RULNET5 to the BBIPARM dataset. +
+ +
+ Or press END to return to Rule Set Filter. +
+ +
+ Note - A cold start refreshes all Rules from BBIPARM. The changes that +
+ you have made will not remain over a cold start unless SAVED. +
+----------------------------------------------------------------------------+
The following example shows how a Rule Set (RULJ911) with filtering enabled lessens the number of events seen by the Rule Set and makes automation with Rules more efficient.
To enable filtering
From the Automation Control panel, type F in the LC column next to the Rule Set.
BMC Software ---------------- Automation Control ----------------- BMC AMI OpsA
COMMAND ===> TGT ===> MVR3
Primary commands: ADD, STATSHOW, CMDSHOW, PARMSHOW, Locate, DATE --- YY/MM/DD
EXPAND TIME --- 17:48:38
Automation Status ===> ACTIVE (Active, Inactive)
Automation Strategy ===> INDIVIDUAL (Individual, All, First)
Honor MPF Suppression ===> NO (NO/YES)
Automation Statistics
Total Events 624 Display suppressed 0
Events Handled 49 Hardcopy suppressed 0
Current arrival rate 3 / sec Rule generated Alerts 6
Peak arrival rate 10 / sec Rule invoked Execs 0
Automation Library
LC CMDS --- (S)elect, (E)nable, (D)isable, (T)est, (SA)ve
(M)ove, (B)efore or (A)fter, (F)ilter Criteria
LC Rule-Set Status Rules Fired Filtered Date Time Strategy
___ RULQUAL1 ENABLED 6 46 624d DD-MMM-YY 13:18:50 FIRST
___ RULJRNL1 ENABLED 108 93 183 DD-MMM-YY 13:18:49 FIRST
___ RULJRNL2 ENABLED 53 6 8 DD-MMM-YY 13:18:49 FIRST
___ RULJRNL3 ENABLED 59 46 32 DD-MMM-YY 13:18:49 ALL
___ RULJRNL4 ENABLED 56 9 17 DD-MMM-YY 13:18:49 FIRST
___ RULJRNL5 ENABLED 37 346 46 DD-MMM-YY 13:18:49 ALL
F__ RULJ911 ENABLED 6 46 46 DD-MMM-YY 13:18:49 FIRST
___ AAORULCC DISABLED N/A N/A N/A N/A N/A
___ AAORULJB DISABLED N/A N/A N/A N/A N/AThe following figure is displayed.
BMC Software ------------------- Filter Criteria ---------------- BMC AMI OpsA
COMMAND ===> TGT --- JPP1
Rule-set === RULSTDRU
Text Description:
Text ID ===> Ignore leading plus ==>
Text String (Enter Below):
Event Type ===> Type of event ( ? for list)
Mode ===> ENABLED (Status - ENABLED/DISABLED)
Press ENTER for Variable Dependencies Panel,
END to apply changes, CANCEL to cancel changesOn the Filter Criteria panel, note how you can specify a Text-ID, Text String, and Event Type on the panel. The filter criteria for this Rule Set specifies that all events with a Text-ID that begins with IM911 and are JRNL events will be processed by the Rules in this Rule Set.
The following table describes the fields on this panel:
Field name
Description
Text ID
Fill in the Text-ID of the event that you want to be seen by this Rule Set. This maximum length of the Text-ID is 16 characters. To have the Rule Set select events with more information, use the Text String field.
Text String
Specify message/event text to be matched in addition to the Text-ID. The maximum length of the Text-ID is 75 characters.
Ignore leading plus
Specify YES so that the filter criteria for this Rule Set ignores a leading plus sign (+) in the text-IDs of write-to-operator messages (WTOs) and allows the Rules within this Rule Set to be search for matching Rules.
Event Type
Specify the event type for the events that will be seen by the Rule Set. You can specify ALRT, ALRM, BRC, CICS, CMD, DB2, EOM, EOS, EXT, HWTO, IMP, IMS, JRNL, MQS, MSG, NVC, NVM, TIME, TLM, VAR.
For the MSG event type,
- If you journal the message, the entire message (including the reply ID) is written to the journal.
- If you use IMFTEXT, the reply ID is stripped from the message.
- WORD1 is the first word after the reply ID.
- TEXT ID is the first word after the reply ID.
- TEXT STRING does not include the reply ID.
Mode
Allows you to enable or disable Rule Set filtering for the Rule Set.
You can specify filter criteria and then disable the filtering for the Rule Set. This option means the Rule Set will be searched for matching Rules for every event the Rule Processor sees.
When Rule Set filtering is disabled, a lowercase d appears in the Filtered column of the Automation Control panel. On the Rule Set Overview panel, a field denotes whether the Rule Set filtering has been enabled or disabled.
Press Enter. The following figure is displayed.
BMC Software ------------ Variable Dependencies - Filter -------- BMC AMI OpsA
COMMAND ===> TGT --- MVR3
Rule-set === RULJ911
OR/
Variable-name Op Variable-Value AND
________________________________ __ ___________________________________ ___
________________________________ __ ___________________________________ ___
________________________________ __ ___________________________________ ___
________________________________ __ ___________________________________ ___
________________________________ __ ___________________________________ ___
________________________________ __ ___________________________________ ___
________________________________ __ ___________________________________ ___
________________________________ __ ___________________________________ ___
________________________________ __ ___________________________________ ___
________________________________ __ ___________________________________ ___
________________________________ __ ___________________________________ ___
________________________________ __ ___________________________________ ___
________________________________ __ ___________________________________
--> ATTENTION: Use ASV command to add ASV criteria to the rule <--
Press ENTER for Ruleset Defaults Panel,
END to apply changes, CANCEL to cancel changesUse this panel to specify variables as additional filter criteria for the Rule Set. You can specify SHARED or LOCAL variables on this panel. Refer to Variables-in-the-Rule-Processor for more information about using variable dependencies for selection criteria.
Press Enter. The following figure is displayed.
BMC Software -------------Rule Set Default Values --------------- BMC AMI OpsA
COMMAND ===> TGT --- JO65
Rule-set === AAORULJO
Ruleset criteria match rate threshold:
If matched ===> (Maximum # times matched within INTERVAL, 1-100)
in seconds ===> (Interval length, 1-99999 seconds)
then status ===> (SUSPEND, DISABLE, NOACTION)
Default ignore leading plus value for MSG rules ==> NO
Press ENTER,for Filter Criteria Panel,
END to apply changes, CANCEL to cancel changesUse this panel to define the default Criteria match rate to be used for each Rule in this Rule Set that does not have a value specified.
You can also specify a default setting for the Rule Set where the all the Rules for MSG events will ignore the leading plus sign (+) that occurs in message text unless the individual Rule has specified NO. Refer to Selection-Criteria-fields where the Ignore leading plus field for individual Rules is documented for more information.
The following table describes the fields on the Rule Set default values panel:
Field name
Description
If matched
Specifies the number of times a Rule can be matched to an event within a certain interval of time.
Possible values range is 1 to 100 times.
This value, also called match count target, is used in conjunction with the in seconds and then status fields to define what event rate is used to prevent the Rule from matching too often.
The Rule Set match rate is reset only when the Rule Set filter is updated or if the BBI-SS PAS is cold started.
in seconds
Is the interval of time, set in seconds, over which the match count will be collected for an event.
Possible interval range is 1 to 99999 seconds.
When a Rule is matched the number of times set in the If matched field within the time interval set in the in seconds field, the action specified in the then status field is taken.
then status
Specifies the mode to which a Rule is set when the number of times it is matched reaches the match count target within a specific time interval. Possible values are as follows:
SUSPEND: Suspends the Rule.
When a Rule is in the SUSPEND state, events will no longer fire this Rule. In a Rule Set with a strategy of FIRST, the event will be eligible to fire a subsequent Rule in this Rule Set. When the match rate falls below the threshold, the Rule will be eligible to fire again.
DISABLE: Disables the Rule.
Event matches to the Rule are ignored when the actual match count exceeds the specified match count target, and the Rule is disabled. You must manually re-enable the Rule.
NOACTION: Takes no action.
When the match count for a Rule exceeds its match rate, the Rule is set for NOACTION. The Rule will match and the fired count will increase, but no actions specified for that Rule will take place. The action is resumed when the match rate falls below the threshold.
Default ignore lead ing plus value for MSG rules
Specify YES so that every MSG and HWTO initiated Rule in this Rule Set, by default, ignores the leading plus sign (+) that often precedes write-to-operator (WTO) messages.
The default is NO.
This setting affects only MSG and HWTO initiated Rules in this Rule Set that do not have a value specified for the Ignore leading plus selection criteria field.
Refer to the description of the Ignore leading plus field in Selection-Criteria-fields for more information about how the setting in this field affects MSG and HWTO initiated Rules.
Press PF3 to return to the Automation Control Panel.
(optional) To view the Rules, from the Automation Control panel, type S in the LC column next to the Rule Set as shown below.
BMC Software ----------------- Automation Control ---------------- BMC AMI OpsA
COMMAND ===> TGT ===> MVR3
Primary commands: ADD, STATSHOW, CMDSHOW, PARMSHOW, Locate, DATE --- YY/MM/DD
EXPAND TIME --- 17:48:38
Automation Status ===> ACTIVE (Active, Inactive)
Automation Strategy ===> INDIVIDUAL (Individual, All, First)
Honor MPF Suppression ===> NO (NO/YES)
Automation Statistics
Total Events 624 Display suppressed 0
Events Handled 49 Hardcopy suppressed 0
Current arrival rate 3 / sec Rule generated Alerts 6
Peak arrival rate 10 / sec Rule invoked Execs 0
Automation Library
LC CMDS --- (S)elect, (E)nable, (D)isable, (T)est, (SA)ve
(M)ove, (B)efore or (A)fter, (F)ilter Criteria
LC Rule-Set Status Rules Fired Filtered Date Time Strategy
___ RULQUAL1 ENABLED 6 46 624d DD-MMM-YY 13:18:50 FIRST
___ RULJRNL1 ENABLED 108 93 183 DD-MMM-YY 13:18:49 FIRST
___ RULJRNL2 ENABLED 53 6 8 DD-MMM-YY 13:18:49 FIRST
___ RULJRNL3 ENABLED 59 46 32 DD-MMM-YY 13:18:49 ALL
___ RULJRNL4 ENABLED 56 9 17 DD-MMM-YY 13:18:49 FIRST
___ RULJRNL5 ENABLED 37 346 46 DD-MMM-YY 13:18:49 ALL
S__ RULJ911 ENABLED 6 46 46 DD-MMM-YY 13:18:49 FIRST
___ AAORULCC DISABLED N/A N/A N/A N/A N/A
___ AAORULJB DISABLED N/A N/A N/A N/A N/AThe following figure is displayed.
BMC Software ----------------- Rule Set Overview ----------------- BMC AMI OpsA
COMMAND ===> TGT --- MVR3
Rule Set ID: RULJ911 Ruleset Strategy ===> FIRST DATE --- YY/MM/DD
Primary commands: Add, Save, Sort, Unsort, Reset, Filter TIME --- 13:23:24
LC CMDS --- (S)elect, (BR)owse, (E)nable, (D)isable, (T)est, (DE)lete, (I)nsert
(C)opy/(CC)opy, (M)ove/(MM)ove, (B)efore or (A)fter, (R)epeat, GO
Rule Set Desc.:
Sort Criterion: Filter ENABLED Scroll right/left
LC Rule-id Stat Text-id Type Fired EXEC Changed ID
________ _ ________________ ____ ________ ________ _____ ________
___ IM9113I ENA IM9113I JRNL 12 YY/MM/DD 16:36 CMF16
___ IM9114I ENA IM9114I JRNL 13 YY/MM/DD 15:28 CMF16
___ IM9117I ENA IM9117I JRNL 0 YY/MM/DD 16:35 CMF16
___ IM9118I ENA IM9118I JRNL 17 YY/MM/DD 08:12 CMF16
___ IM9119I ENA IM9119I JRNL 0 YY/MM/DD 07:52 CMF16
___ ALLJRNL ENA IM911* JRNL 4 YY/MM/DD 08:10 CMF16
************************* END OF DATA **************************The center of this panel shows that the filter is enabled. You also can see in the Text-id fields, the Rules all specify to match with events that begin with IM911. The Type column also shows that all the event types for these Rules are JRNL. There is even a 'catch-all' Rule, Rule-ID ALLJRNL, that will be searched for all events that begin with IM911.
- Press PF3 to exit this Rule Set.If you did not change any Rules, you will not be prompted to save the Rule Set. If you made changes, enter SAVE on the COMMAND line from the Rule Set Overview or enter SAVE when prompted while exiting the Rule Set.