Additional considerations for ALERTs that are sent to BMC IM cells

This topic describes additional considerations for ALERTs that are sent to BMC IM cells.

  • Slots are based on the Slot Name and the last slot value will be used. For example, the mv_alrt_orgn slot contains the origin of an already published ALERT. If mv_alrt_orgn slot is specified in a Rule from the Rule Processor Alert Action(s) III - BiiZ/SIEM panel, or in an EXEC by using the SLOTSTEM keyword, the SLOTSTEM value specified in the Rule or EXEC overrides the original value in the ALERT.

Related topic

ALERT

  • Use caution when specifying a slot that already exists within the ALERT because
    • If the same slot name is specified more than once, the most recently specified slot name overrides any older slot names.
    • If a slot is specified when an ALERT is added, and subsequently the same slot name is specified in a Rule that modifies the ALERT, the value in the Rule overrides the original slot name.

  • When adding an ALERT, the maximum number of slots that you can specify for all three methods (Rules, AOEXEC, IMFEXEC) is eight. When modifying an ALERT with an ALERT-initiated Rule, you can specify an additional eight slots.

    To send 16 slots, you must ensure that the Rule that modifies the ALERT does not specify the name of a slot that already exists in the ALERT.

  • An ALERT that is sent (or targeted) to another BBI-SS PAS cannot be enriched before it is sent to the target BBI-SS PAS.

    Because enrichment values cannot be sent to another BBI-SS PAS, you can specify that an enriched ALERT is sent to a PAS that is not a BMC II for z/OS PAS, or to a BMC AMI Ops Automation BMC II for z/OS PAS.

    Therefore, if an enriched ALERT is sent from one BBI-SS PAS to another, and the receiving BBI-SS PAS is running BMC AMI OpsA  (with BiiZ installed), the enriched ALERT can be sent.

  • The IMFEXEC and AOEXEC READQ commands do not return enriched fields in variables.
Warning

If you specify additional slots on an ALERT that is PUBLISHED, and the slots are not defined on the cell, catch-up (sync) processing will cause ALERTs to be lost.

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*