4 Replies Latest reply: Mar 15, 2012 12:24 PM by Marko Lahtinen RSS

Email notification not triggering after escalating the Severity through mrl rule

Pritam Majumder
Pritam Majumder Mar 7, 2012 3:42 AM

I have written a small mrl rule which will downgrade the event severity to MAJOR anfter 180 secs if the event is still open it will change the severity to CRITICAL.

next I have a notification policy which sends email notification to the server administrator about the event.

 

The first part is achieved successfully but after changing the severity the notification policy is not triggering. The selector is fine and it is matching all the criteria.

So I am confused. can anyne please help? the mrl is below

 

----------------------------------------------------------------------------------------------------------------------------------------------------

new PATROLSTATE_CHANGE :

PATROL_EV ($PEV)

where [     $PEV.status != CLOSED AND

   $PEV.status != BLACKOUT AND 

   $PEV.mc_tool_class =='BII4PATROL 7.3.40' AND

   $PEV.mc_smc_alias != "PATROL_DOWN" AND

   $PEV.msg =='PATROL Agent is unreachable.Server may be down.' ]

triggers

{  

  $PEV.mc_original_severity = $PEV.severity;

  $PEV.severity = 'MAJOR';

  ntadd ($PEV, 'For new PATROL AGENT Down Event, Patrol Agent timer is set to 180 seconds.');

  set_timer ($PEV,60,PATROL_DOWN_CHECK);

}

END

# PATROL_HEARTBEAT_CHECK

#

# Rule updates the event severity to CRITICAL when the heartbeat timer is crosschecked.

timer SET_PATROL_DOWN_CHECK:

PATROL_EV ($PEV)

where [ $PEV.status != CLOSED ]

timer_info : equals PATROL_DOWN_CHECK

{

  ntadd ($PEV,'PATROL_DOWN_CHECK rule fired - updating to CRITICAL - PATROL DOWN event');

  $PEV.severity = 'CRITICAL';

}

END

----------------------------------------------------------------------------------------------------------------------------------------------------

 

Regards,

Pritam

  • 1. Email notification not triggering after escalating the Severity through mrl rule
    Carlos Slone
    Carlos Slone Mar 8, 2012 8:24 AM (in response to Pritam Majumder)

    Pritam,

     

    Severity is an enumeration.  As such, don't enclose the value in quotes.

     

    Your SET_PATROL_DOWN_CHECK rule should read

     

    $PEV.severity = CRITICAL;

     

     

    If that doesn't resolve your problem, please copy your policy/selector and post it here for review.

     

    Thanks,

     

     

    Carlos.

  • 2. Re: Email notification not triggering after escalating the Severity through mrl rule
    Ferry Bolhar
    Ferry Bolhar Mar 8, 2012 8:33 AM (in response to Carlos Slone)

    Since this isn't the first time an enumeration value is used erronously as string, may be a RFE should be that mccomp will complain about this?

  • 3. Email notification not triggering after escalating the Severity through mrl rule
    Pritam Majumder
    Pritam Majumder Mar 12, 2012 3:41 AM (in response to Carlos Slone)

    Hi Carlose

     

    I have changed it to $PEV.severity = CRITICAL;

     

    But still email notification is not happening. I have pasted the notification policy detail below

    ----------------------------------------------------------------------------------------------------------------------------------

    SELECTOR;
    data_handle=2758726;
    mc_udid='mc.bem-server.c7643c0.0';
    mc_creation_time=1282819008;
    mc_modification_time=1331020792;
    mc_modification_requestor='user';
    publish_env_id='';
    based_on='PATROL_EV';
    name='Final_Alerts.Unix_Server_Down_Alerts';
    description='Alerts for unix server down';
    ecfs=['PATROL_EV($EV) where [( $EV.mc_host_class contains ''Linux'' OR $EV.mc_host_class contains ''AIX'' ) AND $EV.msg contains ''PATROL Agent is unreachable.Server may be down.'' AND NOT ( $EV.mc_host contains ''server1'' OR $EV.mc_host contains ''server2'' OR $EV.mc_host contains ''server3'' OR $EV.mc_host contains ''cvflst-ebdb01'' OR $EV.mc_host contains ''cvflst-ebdb02'' OR $EV.mc_host contains ''cvflst-ebad10'' OR $EV.mc_host contains ''server4'' ) AND $EV.severity equals CRITICAL ]'];
    ecfs_descr=['Alerts for unix server down'];
    END

    IM_NOTIFICATION_POLICY;
    data_handle=2758751;
    mc_udid='mc.bem-server.c764436.1';
    mc_creation_time=1282819126;
    mc_modification_time=1329377669;
    mc_modification_requestor='user';
    publish_env_id='';
    name='Unix_Server_Down_Alerts';
    description='Email Alerts for unix server down';
    enabled=1;
    active_timeframes=[];
    except_timeframes=[];
    active_global_timeframes=[];
    except_global_timeframes=[];
    selector_name='Final_Alerts.Unix_Server_Down_Alerts';
    selector_class='PATROL_EV';
    selector_ecf=*Final_Alerts.Unix_Server_Down_Alerts ($EV);
    ordinal=0;
    notification_service='BASIC_EMAIL';
    notify_targets=['AIX.Engineers@domain.com','pritam.majumder@domain.com'];
    notify_on_operations=[OPEN];
    notify_msg_format='%s';
    notify_msg_slots=['$1.msg'];
    auto_ack=0;
    auto_assign=0;
    assign_to_user='';
    END

    ----------------------------------------------------------------------------------------------------------------------------------

     

    Thanks

    Pritam

  • 4. Email notification not triggering after escalating the Severity through mrl rule
    Marko Lahtinen
    Marko Lahtinen Mar 15, 2012 12:24 PM (in response to Ferry Bolhar)

    ma14pg6 wrote:

     

    Since this isn't the first time an enumeration value is used erronously as string, may be a RFE should be that mccomp will complain about this?

     

    I'm pretty sure that it does this nowadays after battling with "type errors" all day. I made the same mistake of trying to compare a STRING to SEVERITY.