4 Replies Latest reply on Mar 15, 2012 12:24 PM by Marko Lahtinen

    Email notification not triggering after escalating the Severity through mrl rule

    Pritam Majumder Mar 7, 2012 3:42 AM

      I have written a small mrl rule which will downgrade the event severity to MAJOR anfter 180 secs if the event is still open it will change the severity to CRITICAL.

      next I have a notification policy which sends email notification to the server administrator about the event.

       

      The first part is achieved successfully but after changing the severity the notification policy is not triggering. The selector is fine and it is matching all the criteria.

      So I am confused. can anyne please help? the mrl is below

       

      ----------------------------------------------------------------------------------------------------------------------------------------------------

      new PATROLSTATE_CHANGE :

      PATROL_EV ($PEV)

      where [     $PEV.status != CLOSED AND

         $PEV.status != BLACKOUT AND 

         $PEV.mc_tool_class =='BII4PATROL 7.3.40' AND

         $PEV.mc_smc_alias != "PATROL_DOWN" AND

         $PEV.msg =='PATROL Agent is unreachable.Server may be down.' ]

      triggers

      {  

        $PEV.mc_original_severity = $PEV.severity;

        $PEV.severity = 'MAJOR';

        ntadd ($PEV, 'For new PATROL AGENT Down Event, Patrol Agent timer is set to 180 seconds.');

        set_timer ($PEV,60,PATROL_DOWN_CHECK);

      }

      END

      # PATROL_HEARTBEAT_CHECK

      #

      # Rule updates the event severity to CRITICAL when the heartbeat timer is crosschecked.

      timer SET_PATROL_DOWN_CHECK:

      PATROL_EV ($PEV)

      where [ $PEV.status != CLOSED ]

      timer_info : equals PATROL_DOWN_CHECK

      {

        ntadd ($PEV,'PATROL_DOWN_CHECK rule fired - updating to CRITICAL - PATROL DOWN event');

        $PEV.severity = 'CRITICAL';

      }

      END

      ----------------------------------------------------------------------------------------------------------------------------------------------------

       

      Regards,

      Pritam

        • 1. Email notification not triggering after escalating the Severity through mrl rule
          Carlos Slone
          Carlos Slone Mar 8, 2012 8:24 AM (in response to Pritam Majumder)

          Pritam,

           

          Severity is an enumeration.  As such, don't enclose the value in quotes.

           

          Your SET_PATROL_DOWN_CHECK rule should read

           

          $PEV.severity = CRITICAL;

           

           

          If that doesn't resolve your problem, please copy your policy/selector and post it here for review.

           

          Thanks,

           

           

          Carlos.

          • 2. Re: Email notification not triggering after escalating the Severity through mrl rule
            Ferry Bolhar Mar 8, 2012 8:33 AM (in response to Carlos Slone)

            Since this isn't the first time an enumeration value is used erronously as string, may be a RFE should be that mccomp will complain about this?

            • 3. Email notification not triggering after escalating the Severity through mrl rule
              Pritam Majumder Mar 12, 2012 3:41 AM (in response to Carlos Slone)

              Hi Carlose

               

              I have changed it to $PEV.severity = CRITICAL;

               

              But still email notification is not happening. I have pasted the notification policy detail below

              ----------------------------------------------------------------------------------------------------------------------------------

              SELECTOR;
              data_handle=2758726;
              mc_udid='mc.bem-server.c7643c0.0';
              mc_creation_time=1282819008;
              mc_modification_time=1331020792;
              mc_modification_requestor='user';
              publish_env_id='';
              based_on='PATROL_EV';
              name='Final_Alerts.Unix_Server_Down_Alerts';
              description='Alerts for unix server down';
              ecfs=['PATROL_EV($EV) where [( $EV.mc_host_class contains ''Linux'' OR $EV.mc_host_class contains ''AIX'' ) AND $EV.msg contains ''PATROL Agent is unreachable.Server may be down.'' AND NOT ( $EV.mc_host contains ''server1'' OR $EV.mc_host contains ''server2'' OR $EV.mc_host contains ''server3'' OR $EV.mc_host contains ''cvflst-ebdb01'' OR $EV.mc_host contains ''cvflst-ebdb02'' OR $EV.mc_host contains ''cvflst-ebad10'' OR $EV.mc_host contains ''server4'' ) AND $EV.severity equals CRITICAL ]'];
              ecfs_descr=['Alerts for unix server down'];
              END

              IM_NOTIFICATION_POLICY;
              data_handle=2758751;
              mc_udid='mc.bem-server.c764436.1';
              mc_creation_time=1282819126;
              mc_modification_time=1329377669;
              mc_modification_requestor='user';
              publish_env_id='';
              name='Unix_Server_Down_Alerts';
              description='Email Alerts for unix server down';
              enabled=1;
              active_timeframes=[];
              except_timeframes=[];
              active_global_timeframes=[];
              except_global_timeframes=[];
              selector_name='Final_Alerts.Unix_Server_Down_Alerts';
              selector_class='PATROL_EV';
              selector_ecf=*Final_Alerts.Unix_Server_Down_Alerts ($EV);
              ordinal=0;
              notification_service='BASIC_EMAIL';
              notify_targets=['AIX.Engineers@domain.com','pritam.majumder@domain.com'];
              notify_on_operations=[OPEN];
              notify_msg_format='%s';
              notify_msg_slots=['$1.msg'];
              auto_ack=0;
              auto_assign=0;
              assign_to_user='';
              END

              ----------------------------------------------------------------------------------------------------------------------------------

               

              Thanks

              Pritam

              • 4. Email notification not triggering after escalating the Severity through mrl rule
                Marko Lahtinen Mar 15, 2012 12:24 PM (in response to Ferry Bolhar)

                ma14pg6 wrote:

                 

                Since this isn't the first time an enumeration value is used erronously as string, may be a RFE should be that mccomp will complain about this?

                 

                I'm pretty sure that it does this nowadays after battling with "type errors" all day. I made the same mistake of trying to compare a STRING to SEVERITY.