|
|
Hi ![CDATA[ Anyone can share information about the primitive smcomps ? I'm interest to examples, documentation, etc... The follow is a example of use of smcomps. -- <br />execute get_impacted_srvc_ids:<br />EVENT ($EV) where [<br /> $EV.mc_smc_id != "" AND<br ... .status == OPEN<br />{<br /> # direction = impact, impact = true<br /> smcomps
|
|
|
Hi, ![CDATA[ You can use smcomps() primitive. It is not documented in manuals but here you can find info about smcomps(): ![CDATA[ http://communities.bmc.com/communities/thread/9497 Regards, Mariusz
|
|
|
I second that. ALL valuable content from the old SIEM-forums (NOT Devcon - as SIEM-Devcon-forums were correctly merged into Developer-Network) is lost. A search for smcomp() only reveals this post .... -Markus
|
|
|
I ended up achieving this using the smcomps primitive. I got a document from BMC support detailing it with examples. With that doc I wrote a couple of rules that look up any impacts a raw event causes. The flip side to that was a rule that is triggered on a SMC_EVENT for applications and Services that looks down its model to see which components have events against them which caused
|