9 Replies Latest reply on Jan 9, 2017 2:17 AM by Emanuele Longo

    BPPM - New event open when the event change its severity

    Emanuele Longo

      Hi all,

       

      I need that, when  the event open change the severity,BPPM should open the same event with new severity.

      Is it possible configure BPPM for this custom functionality?

      Does anyone has suggestions for me?

      From documentation seems not possible..

       

      Regards,

      EmA

        • 1. Re: BPPM - New event open when the event change its severity
          Bhuvaneswaran Ekanathan

          Emanuele Longo

           

          It is easy to configure based on your comfort level with MRL [refine rule phase] or Policy [Enrichment Policy]. Below links are for TrueSight version 10.5.00 but functionality and syntax remains same for lower versions of BPPM as well.

           

          For MRL,

           

          Refine rule syntax - BMC TrueSight Infrastructure Management 10.5 - BMC Documentation

           

          For Policy,

           

          Creating a new enrichment policy - BMC TrueSight Infrastructure Management 10.5 - BMC Documentation

           

          Hope it helps

           

          Thanks,

          Bhuvan

          • 2. Re: BPPM - New event open when the event change its severity
            Emanuele Longo

            Hello Bhuvan,

             

            Can you do any example of configuration?

             

            Thanks,

            Ema

            • 3. Re: BPPM - New event open when the event change its severity
              Bhuvaneswaran Ekanathan

              Hi Ema,

               

              Can you provide the use case scenario, I will explain the same.

               

              Thanks,

              Bhuvan

              • 4. Re: BPPM - New event open when the event change its severity
                Emanuele Longo

                Surely!

                 

                Scenario:

                Step 1) event generated by BPPM;

                Step 2) If this event is about to change its severity then I want that BPPM create a new event equal to previous event described with the new severity.

                The first event must remain with first severity that it had.

                 

                Thanks,

                EmA

                • 5. Re: BPPM - New event open when the event change its severity
                  Bhuvaneswaran Ekanathan

                  Hi Ema,

                   

                  This is out of box feature of BPPM [default enabled MRL in cell]. For example, you are monitoring CPU Utilization of a server with 80% threshold for Warning and 90% threshold for CRITICAL. For instance, when utilization is 82% during 10:00 AM poll, then a WARNING event will be received in cell and during 10:15 poll, if utilization is 94%, a new event will be received in cell but default enabled MRL will de-duplicate the existing event and update the event slots [severity, parameter value, message, etc.,] and drop the NEW event.

                   

                  But if you have a requirement to keep WARNING event OPEN and create a NEW CRITICAL severity event, it is very well possible. You need to identify the MRL for de-duplication and review it and disable it from .load file or comment out a specific section in default rule.

                   

                  Can you export a sample event in baroc format and share it. This will provide the default MRLs execution and which rule is responsible for de-duplication

                   

                  Hope it helps

                   

                  Thanks,

                  Bhuvan

                  • 6. Re: BPPM - New event open when the event change its severity
                    Emanuele Longo

                    Hi Bhuvan,

                     

                    I cannot to identify  the MRL for de-duplication...

                    Please could you suggest me any MRL custom code to reach my feature desired?

                     

                    Thanks,

                    EmA

                    • 7. Re: BPPM - New event open when the event change its severity
                      Charles Kelley

                      Hi Emanuele,

                       

                      I'm not sure why you would want to do this, and do not necessarily suggest it.  I think you'll unnecessarily generate many events, and eventually force good events to be cleaned out of the event database to make room for these new events.  So, I think that you may not like the long term results... however, I do not know the full use case.

                       

                      Plus, you would not want to do this on internal events (ALARM, ABNORMALITY) generated by rate, because those new events would not have any correlation in the database to the alarm that rate knows about.

                       

                      So, such an example should only be used on external (non Rate generated) events.  Is that your intention?

                       

                      That being said, here's an example (use at your own risk):

                       

                      execute generate_new_severity_event: EVENT ($EV)

                        where [ CLASS: outside [ALARM, ABNORMALITY] ]

                      when $EV.severity

                      {

                        if ($EV.severity != $EV.mc_original_severity) then

                        {

                          $NEWSEVERITY = $EV.severity;

                          $EV.severity = $EV.mc_original_severity;

                          generate_event($EV.CLASS,

                           [

                             msg = $EV.msg,

                             mc_parameter = $EV.mc_parameter,

                             severity = $NEWSEVERITY

                            #continue adding as much to the new event as you like

                         ])

                        };

                      }

                      END

                       

                      I haven't tested this rule, and I do not necessarily recommend using it because of the above stated reasons... You may not like what this does to your environment.

                       

                      Charles

                      • 8. Re: BPPM - New event open when the event change its severity
                        Bhuvaneswaran Ekanathan

                        Charles Kelley

                         

                        As you mentioned, this is not a recommended approach however I have seen Customers requesting the functionality mainly for Reporting & Incident tracking.

                         

                        In my opinion, it will be easier to identify the default MRL responsible for de-duplication and comment it out or customize to the requirement [for instance, have ECF for rate events and exempt for external events].

                         

                        Emanuele Longo

                         

                        From BPPM Operations console, export a sample event in BAROC format where same event is updated with new severity and share it. This will provide details of default MRLs executed for the event.

                         

                        Thanks,

                        Bhuvan

                        • 9. Re: BPPM - New event open when the event change its severity
                          Emanuele Longo

                          Hello Bhuvan,

                           

                          Below I insert the export of event updated with new severity:

                           

                          ALARM;

                            adapter_host='';

                            administrator='PPM';

                            date='20170104163732.000000+060';

                            date_reception=1483544252;

                            duration=0;

                            event_handle=9309565;

                            itsm_category='Hardware';

                            itsm_company='Callbro S.p.A.';

                            itsm_incident_id='INC000000110106';

                            itsm_incident_status='Assigned';

                            itsm_item='Server';

                            itsm_location='';

                            itsm_manufacturer='HP';

                            itsm_model_version='ProLiant DL360 G4p';

                            itsm_operational_category1='';

                            itsm_operational_category2='';

                            itsm_operational_category3='';

                            itsm_product_name='fileshare.local';

                            itsm_type='Processing unit';

                            mc_abstracted=[];

                            mc_abstraction=[];

                            mc_account='';

                            mc_acl=[];

                            mc_action_count=0;

                            mc_arrival_time=1483544266;

                            mc_associations=['pncell_BPPM-host:1030'];

                            mc_bad_slot_names=[];

                            mc_bad_slot_values=[];

                            mc_cause=0;

                            mc_client_address='10.174.165.01';

                            mc_collectors=['1.1','2.1.1','3.1.1','4.10','5.1','9.1.1','12.7.1','13.1'];

                            mc_date_modification=1483945827;

                            mc_effects=[];

                            mc_event_category=;

                            mc_event_model_version='1.1.00';

                            mc_event_relations=['biiars_event_association','HD_Ticket_INC000000110106'];

                            mc_event_subcategory=SYSTEM;

                            mc_history=[];

                            mc_host='fileshare.local';

                            mc_host_address='10.12.10.229';

                            mc_host_class='';

                            mc_host_id=3015;

                            mc_incident_report_time=0;

                            mc_incident_time=1483944012;

                            mc_local_reception_time=1483544266;

                            mc_location='';

                            mc_long_msg='';

                            mc_modhist=['pncell_BPPM-host'];

                            mc_notes=[];

                            mc_notification_history=[];

                            mc_object='fileshare.local@C:';

                            mc_object_class='NT_LOGICAL_DISKS';

                            mc_object_owner='';

                            mc_object_uri='';

                            mc_operations=['0x587276c3','user10','','IBRSDBEM','ibrsd','0x586d16ca','mc_ci_policies.mrl:refine ci_based_enrich_policy_rule','ITSM_Categorie','CI based enrichment',''];

                            mc_origin='';

                            mc_origin_class='';

                            mc_origin_key='';

                            mc_origin_sev='';

                            mc_original_priority=PRIORITY_5;

                            mc_original_severity=MINOR;

                            mc_owner='user10';

                            mc_parameter='Free Space';

                            mc_parameter_threshold='4.0';

                            mc_parameter_unit='%';

                            mc_parameter_value='3,59';

                            mc_priority=PRIORITY_5;

                            mc_propagations=['ibrsd:1','bpre.repoeng-host-bmc.com:51881','pn_server_bppm-host:4359'];

                            mc_relation_source='';

                            mc_relationships='1/1';

                            mc_service='';

                            mc_smc_alias='OI-F150BA16316B4008A99267409E3B081B';

                            mc_smc_causes=[];

                            mc_smc_effects=[];

                            mc_smc_id='OI-F150BA16316B4008A99267409E3B081B';

                            mc_smc_impact=IMPACTING;

                            mc_smc_priority=0.136242566211434;

                            mc_smc_type='BMC_ComputerSystem';

                            mc_timeout=0;

                            mc_tool='bppm-host';

                            mc_tool_address='10.174.165.22';

                            mc_tool_class='PNET';

                            mc_tool_id='';

                            mc_tool_key='1943300';

                            mc_tool_rule='';

                            mc_tool_sev='';

                            mc_tool_suggestion='';

                            mc_tool_time=1483544252;

                            mc_tool_uri='';

                            mc_ueid='bppm-host-alr-389594';

                            mc_using_organization='IT';

                            mc_using_organization_id='-1';

                            msg='Logical Disk Free Space < 4%  for 30 min.';

                            pn_alarm_exec_notify=FALSE;

                            pn_alarm_id=389594;

                            pn_baseline_type=NO;

                            pn_detail_diag=0;

                            pn_detail_diag_count=0;

                            pn_device_name='fileshare.local';

                            pn_end_time=2147483647;

                            pn_extremeness=0;

                            pn_group_ids=[];

                            pn_groups=[];

                            pn_highest_severity=MAJOR;

                            pn_invoke_alarm_rule=TRUE;

                            pn_is_predicted=FALSE;

                            pn_is_suppressing=FALSE;

                            pn_last_time=1483945817;

                            pn_object_class_id=501024;

                            pn_object_id=1268764;

                            pn_old_severity=MINOR;

                            pn_parameter_id=501024505;

                            pn_predict_to_occur_time=0;

                            pn_predicted_severity=;

                            pn_suppress_mode=NORMAL;

                            pn_suppress_notified=TRUE;

                            pn_suppress_primary_alarm_id='';

                            pn_suppress_rule_id=0;

                            pn_suppress_type=NONE;

                            pn_thresh_above=FALSE;

                            pn_thresh_duration=1800;

                            pn_thresh_id=10822;

                            pn_thresh_type=156;

                            pn_vm_host='';

                            pn_vm_host_id=0;

                            repeat_count=0;

                            severity=MAJOR;

                            status=OPEN;

                          END

                           

                           

                          EmA