1 2 Previous Next 17 Replies Latest reply: Jun 24, 2012 10:51 AM by Przemyslaw Danysz RSS

Patrol KM: Catch event before send to PEM?

Przemyslaw Danysz

Hi!

 

Today I have question for you, about trying to catch event before goes to Patrol Event Manager.

For example, using FILESYSTEM KM and FSMountStatus parameter I recive the message:

 

"Alarm #2 of global parameter 'FSMountStatus' triggered on 'FILESYSTEM.blagent'.  1 <= 1.00 <= 2"

it's means, that FS is unmounted,

 

Now, I would like to modyfiy this message (add more informations about this FS [for example]) before KM send it to PEM...it is even possible?

Is possible to Define a action when parameters changed values? eg. when CPU reaches alarm range - trigger event ( event_trigger(), but message defined by me )?

 

Only what i found is "RECOVERY ACTION", where I can put PSL commands and tigger event width my message, but what I want to possibility to modyfiy origilnal message created by the KM.....

 

any ideas?:)

  • 1. Re: Patrol KM: Catch event before send to PEM?
    Jonathan Coop

    If you have the latest agent it is possible to reword events details in the Patrol agent reference manual. Jon

     

    Sent from my iPhone

  • 2. Patrol KM: Catch event before send to PEM?
    rasto danis

    these messages are standard ones (handled via StdEvents.ctg file - mainly events number 9 and 11) - same for each parameter of each km. what you can do is modify this file - but it will affect all kms on that agent..

    what exactly do you want to add to events what is not already in and can be used during reqording in bem ? usually we only reword events on bem/sim side and you can have message like "filesystem <name> was unmounted." instead of this standard message (alarm xyz triggered..)

  • 3. Re: Patrol KM: Catch event before send to PEM?
    Oleg Protokolov

    Hi,

     

    In my practice, for solving this problem I used a bunch: PATROL KM for Event Management (see chapter "Rewording Notification Messages" of "PATROL Knowledge Module for Event Management User Guide") + Recovery Actions, by which I set the value of %AS_USERDEFINED% (see chapter "NOTIFY_EVENT Fields" of the same doc).

     

    If need, I can describe this method in more details...

     

    On the other hand, if you are using BMC Impact Manager, you can also override the messages through Dynamic Enrichment Policy (search for "TextTranslation" inside "BMC Impact Solutions Event Management Guide.pdf" or read chapter "Overview of the PATROL messaging text translation dynamic data enrichment source file").

    For our country it is a good opportunity, because I can create messages in russian language

     

    --

    Regards,

    Oleg

  • 4. Patrol KM: Catch event before send to PEM?
    Przemyslaw Danysz

    Rastro - thanks is good tip.

    I can't use changing messages vis BMC Impact Manager/Explorer, becouse I need changed it on Agent side.

     

    OProtokolov - thanks for info, could you give more information?, I just downloaded that giude, but its take some time to read this out, and make some tests,...so yours knowdlege will be very helpfull

  • 5. Re: Patrol KM: Catch event before send to PEM?
    Jonathan Coop

    The easier way is as I said before see the section Defining event descriptions in the Agent reference manual, which allows reword of an event of std class according to class instance and parameter example:

     

    /EventRules/STD/28/NT_CPU/NT_CPU/CpuPercent value: SUBSTITUTE=my new text

     

    You can also use macros this much easier than using recovery actions. Jon

     

    Sent from my iPhone

  • 6. Re: Patrol KM: Catch event before send to PEM?
    Oleg Protokolov

    Hi,

     

    Here is example...

    1. Create the text-file 'fs_km_settings.cfg' and put into it this:

    PATROL_CONFIG

    "/AgentSetup/preloadedKMs" = { MERGE = "EVENT_MANAGEMENT.kml" },

    "/AS/EVENTSPRING/allowInfoRecoveryActions" = { REPLACE = "1" },

    "/AS/EVENTSPRING/ALERT/MSG/FILESYSTEM/__ANYINST__/FSMountStatus/msgText" = { REPLACE = "%USERDEFINED%" },

    "/AS/EVENTSPRING/FILESYSTEM/__ANYINST__/FSMountStatus/arsAction" = { REPLACE = "6" },

    "/AS/EVENTSPRING/FILESYSTEM/__ANYINST__/FSMountStatus/arsCmdType" = { REPLACE = "PSL" },

    "/AS/EVENTSPRING/FILESYSTEM/__ANYINST__/FSMountStatus/arsCommand" = { REPLACE = "switch ( __param_value__ ) \

    {\

      fsName = get( join( \"/\", __appl_class__, __instance__, \"name\" ) );\

      case 0:\

      {\

        __udefvar__ = sprintf( \"Filesystem '%s' successfully mounted\\t\", fsName );\

      }\

      case 1:\

      {\

        __udefvar__ = sprintf( \"Filesystem '%s' is unmounted\\t\", fsName );\

      }\

      default:\

      {\

        __udefvar__ = sprintf( \"Unable to dectect the state of '%s' filesystem\\t\", fsName );\

      }\

    }"

    }

     

    2. Apply this configuration setting to your test PATROL Agent via comman:

    pconfig -host <YourPatrolAgent> -port <PatrolAgentPort> fs_km_settings.cfg

     

    3. For tests switch the demo-filesystem into 'ALARM' state and then to 'OK'

     

    If all settings are made correctly, you get something like this...

    fs_tests.png

     

    Notes:

    - The first ALARM message was created for FSMountStatus value = 1

    - The second ALARM message was created for FSMountStatus value = 2

     

    --

    Regards,

    Oleg

  • 7. Re: Patrol KM: Catch event before send to PEM?
    Przemyslaw Danysz

    Oleg!

     

    thanks a lot, it helps, but now I have situation where PEM recive 2 Notification about "unmounted FS" - check screenshot below:

     

    patrol events.JPG

     

    Any idea how do "disable" the other one? ("Alarm 2 #of ........") ?

  • 8. Re: Patrol KM: Catch event before send to PEM?
    Oleg Protokolov

    Hi,

     

    Which console you plan use as final Event Management System? PATROL Classic Console, BMC Impact Explorer or ...?

     

    If possible, can you explain in more details the event's flow in your monitoring system?

    Maybe I can find a more optimal way of solving the problem.

     

    Thanks!

     

    --

    Regards,

    Oleg

  • 9. Re: Patrol KM: Catch event before send to PEM?
    Jonathan Coop

    My suggestion of rewording at the agent using config variables only generates one event as normal.

     

    Sent from my iPhone

  • 10. Patrol KM: Catch event before send to PEM?
    Przemyslaw Danysz

    Oleg, JonCoop

     

    We are using a BMC Impact Explorer as one, big, event console. We integrated it with may thee parts monitoring software.

     

    Here is example:
    BMC Patrol -> BMC Connector -> BMC Impact Explorer (BEM/SIM)

    IBM Tivoli Monitoring -> "Plugin" -> BEM/SIM

    SCOM -> "plugin" -> BEM/SIM

    ..etc.

     

    so, ours Monitoring Department is using BMC IE as one events collector console, so I need to have possibility to rewrite a specific message. We have hundred of unix systems (monitored by Patrol) belongs to different clients and have different SLAs. Patrol is to poor with "normal" configuration - it's mean, I can't add additional information to "Patrol" about host/FS/..etc, so it's a big problem when Event is created, becouse without additional information,  Monitoring Team have a problem with make a phone calls to specify client.

     

    I read about "rewording", but I think my skils at that advanced configuration are to low , so could you put some example here JonCoop?, or give a tip how to configure for one parameter?:)

     

    Thanks a lot of good ideas and tips at now, and I waiting for more

     

    Regards,

    Przemek

  • 11. Re: Patrol KM: Catch event before send to PEM?
    Garland Smith

    Message rewording is possible using PKM for Event Management.  There's plenty of ability to capture informaiton from the PatrolAgent namespace and environment to include in your notifications.  Check out the PKM for Event Management User Guide for details.

     

    Regards,

    Garland Smith

  • 12. Re: Patrol KM: Catch event before send to PEM?
    Jonathan Coop

    As I said before, this is inbuilt into the agent now.

     

    You can set an agent variable such as:

     

    /EventRules/STD/28/NT_CPU/NT_CPU/CpuPercent

    with a value such s:

     

    SUBSTITUTE=my new text

     

    Now the parameter CpuPercent  for the instance NT_CPU for the class NT_CPU

    will generate events with the text "my new text", it's all in the manual!.

     

     

    set the pconfig variable using PCM, wpconfig, or the command line example:

     

    create a file with the contents say mreword.cfg

     

    PATROL_CONFIG

    "/EventRules/STD/28/NT_CPU/NT_CPU/CpuPercent" = { REPLACE = "SUBSTITUTE=my

    new text"}

     

    If you put more than one rules in your file then comma separate them

    (except the last rule), then send to as many servers as you want with the

    command

     

    pconfig -p 3181 -host host1,host2,host3 myreword.cfg

     

    Jon

  • 13. Re: Patrol KM: Catch event before send to PEM?
    Jonathan Coop

    Should have said STD indicated that we are substituting for a STD event, and the 28 indicates we are rewording event class 28.

     

    Jon

  • 14. Re: Patrol KM: Catch event before send to PEM?
    Oleg Protokolov

    Przemek, Hi!

     

    BMC Connector - you mean this is a "BMC Impact Integration for PATROL7"? If so, there is a good news for you.You can flexibly customize the generation of messages on the BEM side.

    For details see following chapters:
    - "How dynamic data enrichment event management policies work",
    - "Overview of the PATROL messaging text translation dynamic data enrichment source file"
    - "Using the sample PATROL messaging text translation dynamic data enrichment source file"

    of this doc "BMC Impact Solutions Event Management Guide - 97714.pdf"

     

    Notes:
    For our Clients, we replaced the original version of TextTranslation.csv by our own. The number of input slots to it increased. For your case (considering a possible future needs) I would recommend the following set of input slots:

     

    mc_object_class,mc_object,mc_parameter,mc_parameter_value,severity

     

    Example of TexTranslation messages for your case:
    ...
    FILESYSTEM,*,FSMountStatus,*,*,*,Unable to dectect the state of '%pes_icon_name%' filesystem
    FILESYSTEM,*,FSMountStatus,1,*,*,Filesystem '%pes_icon_name%' is unmounted
    FILESYSTEM,*,FSMountStatus,0,*,*,Filesystem '%pes_icon_name%' successfully mounted
    ...

     

    This approach does not require configuration of Recovery Actions, and fill the variable '__ udefvar__' as I described in my previous posts.
    BMC Event Manager - is more powerfull EMS-engine to customizing messages, event's processing, than PATROL

     

    Przemek, if need step by step guide (how to modify Dynamic Enrichment Policy, etc.), let me know...

     

    --

    Regards,

    Oleg

1 2 Previous Next