1 Reply Latest reply on Feb 7, 2018 5:43 AM by Stewart Crighton

    Dynamic When Clause

    Stewart Crighton

      Greetings -

       

      I am attempting to use the when clause from the document:

       

      When clause - BMC TrueSight Infrastructure Management 10.7 - BMC Documentation

       

      However; it will not work when I have more than one entry on the table (CUST_CAUSE_CORRELATE).  One of the entries will work, but the rest will not.  I have tested both entries individually, and they work as expected.  It is just when I put both in at the same time that I get an issue.

       

      Has anyone tried to do this, and made it work?

       

      The basics of the correlate rule come from the EOT rule set.  This modification is to allow it to be more dynamic.

       

      Thank you;

      Stewart

       

      CUST_CAUSE_CORRELATE;

      ...

              time_window=600;

              when_action=CLOSED;

              when_slot=status;

              when_operator=equals;

              when_value=CLOSED;

      ...

      END

       

      CUST_CAUSE_CORRELATE;

      ...

              time_window=600;

              when_action=OPEN;

              when_slot=status;

              when_operator=equals;

              when_value=OPEN;

      ...

      END

       

      correlate cause_everything:

      using_policy ALL

      {

         CUST_CAUSE_CORRELATE($CC)

      }

      EVENT ($EFFECT)

      with EVENT ($CAUSE)

      where [  listlen($CAUSE.bmcps_correlation_cause_domains) not_equals 0 AND

              len($EFFECT.bmcps_correlation_effect_domain) not_equals 0 AND

              $EFFECT.bmcps_correlation_effect_domain  within $CAUSE.bmcps_correlation_cause_domains AND

              $EFFECT.bmcps_correlation_key within $CAUSE.bmcps_correlation_targets AND

              $CAUSE.severity >= WARNING AND

              $EFFECT.severity >= WARNING AND

              (

                $CC.Effect_domain == $EFFECT.bmcps_correlation_effect_domain OR

                $EFFECT.bmcps_correlation_effect_domain has_prefix $CC.Effect_domain

              ) AND

              $CC.Cause_domain within $CAUSE.bmcps_correlation_cause_domains

            ]

      within $CC.time_window

      when($CAUSE, $CC.when_slot, $CC.when_operator, $CC.when_value)

      {

      ...

      }

        • 1. Re: Dynamic When Clause
          Stewart Crighton

          Greetings -

           

          It appears that the issue is filtering the data table in the Where Clause.  I do not know why that is the issue, but I could see it causing problems.

           

          So I modified the rule to use a Policy to drive the When Clause.  Then use the data tables to drive the actions.  At that point all my tests started to function as expected.

           

          The one down side to this is that the entries on the Policy table will execute for every correlation I have.  So for example if I put in an entry for status=OPEN on the Cause event.  Any time I have a Cause Event open, this will run. 

           

          I think the internal logic of the rule handles this, so it should not be an issue.  Just something to keep in mind.

           

          Once I have the code cleaned up a bit, I will make a new thread with the logic. 

           

          Thank you;

          Stewart