1 Reply Latest reply: Apr 4, 2007 10:40 AM by Thanatos RSS

Rules for Alert Resend.

Thanatos

Hi,

I've implemented the alert resend for all my patrol agents.

All this alerts are routed to BEM via the BII4Patrol.

Due to the differences between the genuine first patrol alerts and the subsequents alerts send by the notification process, i was obliged to rewrite all the rules of the BII4patrol and add other rules to "concatenate" all events from a same agent and same parameters.

The aim of the modification is to obtain a "repeat count" with only one alert open for each parameter/agent.

The repeat count from a notification server is not actually supported by the native BEM rules .

  • 1. RE: Rules for Alert Resend.
    Thanatos

    Here the rule to stack the events for the repeat count.
    repeated events are du to a configuration of the PKEM.
    Once the first event is opened (normal event), I receive a notify event each ten minutes.
    I copy the new data on the old one, and increment a repeat count.

    new adapt_param_status : PATROL_EV($NEW)
    where [
                p_catalog:      within ,
                p_class:        within
    ]
    using ALL
    {
    PATROL_IDX ($IDX)
    where [
    $IDX.p_origin == $NEW.p_origin,
    $IDX.p_agent_port == $NEW.p_agent_port,
    $IDX.p_source_id == $NEW.p_source_id
    ]
    PATROL_EV ($OLD)
    where [
    $OLD.mc_ueid == $IDX.patrol_ueid,
                $OLD.p_catalog  within  ,
                $OLD.p_class    within  ,
    $OLD.status != CLOSED
    ]
    }
    triggers
    {
    if ($NEW.p_class == '9') then
    #Close message, this alert is over
    {
    #adding rule closed in operation slot
    opadd($OLD, "RULE_CLOSED", "");
    $OLD.status = CLOSED ;
    $OLD.msg = concat(["## FERME ## ",$OLD.msg]);
    } else {
    #Getting informations of the new event to the first one
    $OLD.mc_parameter_value = $NEW.mc_parameter_value ;
    $OLD.pes = $NEW.pes ;
    $OLD.pes_parent_instance = $NEW.pes_parent_instance ;
    $OLD.pes_param_status = $NEW.pes_param_status ;
    $OLD.pes_alert_date = $NEW.pes_alert_date ;
    $OLD.pes_alert_time = $NEW.pes_alert_time ;
    $OLD.pes_tz = $NEW.pes_tz ;
    $OLD.repeat_count = $OLD.repeat_count + 1 ;
    $OLD.severity = $NEW.severity ;
    $OLD.msg = $NEW.msg ;
    $OLD.p_args = $NEW.p_args ;
    $OLD.console = $NEW.console ;
    $OLD.application = $NEW.application ;
    $OLD.collecteur = $NEW.collecteur ;
    $OLD.consigne = $NEW.consigne ;
    $OLD.group_assign_host = $NEW.group_assign_host;
    $OLD.group_assign_event = $NEW.group_assign_event;
    $OLD.operating_system = $NEW.operating_system;
    if ( $OLD.status == 'OPEN' AND $NEW.status == 'BLACKOUT' ) then {
    opadd($OLD, "Passage en Blackout", "");
    };
    if ( $NEW.status == 'OPEN' AND $OLD.status == 'BLACKOUT' ) then {
    opadd($OLD, "Sortie de Blackout", "");
    };
            if ( $OLD.status within ) then {
    $OLD.status = $NEW.status ;
    };
    };
    #Dropping the new event, after copying all the new informations
    drop_new;
    }
    END

    I used a special rule to closed all the open events when my agent restart.