1 Reply Latest reply on May 20, 2019 7:40 AM by Roland Pocek

    How to differentiate rate alerts in TSIM

    Pradeep Nagar
      Share:|

      Hello All
      In one of our region we have different entities and we treat them differently in terms of alert operations. For example, we have entity A, B, C and D and all are having different MRLs and Enrichment rules.

      We are migrating servers from existing Patrol 7 infrastructure to Truesight 11.3. And for these 4 entity servers we created 4 integration services and all the alerts triggered from Patrol will be propagated to their respective entity adapter cell in BEM. Now all these 4 integration services are pointing to single TSIM and we do not have any way to differentiate rate engine alerts (threshold breach alerts) generated from these 4 entities so we can not apply their respective MRL and enrichment rules.

       

      We thought a custom solution like maintain a host-entity mapping table in pncell at TSIM level and assign entity value to some mc slot and differentiate alert based on this mc_entity slot.

      But we are not in favor of implementing any custom solution and looking if anyone came across such scenarios and have any out of the box solution to cater this requirement.


      Thanks in advance !

        • 1. Re: How to differentiate rate alerts in TSIM
          Roland Pocek

          hi Pradeep Nagar

           

          for me this sounds like different tenants which would be a truesight usecase to use different reals im RSSO. but for this you would need a seperate TSIM for each of the tenant. then the data would be completely seperated and maintained in the seperate TSIM's, accessible over 1 TSPS.

           

          on the other hand an option could be use patrol events only and tag them somehow in the respective cell since you are pushing the events to different cells. if you use the server thresholds in TSIM then all the data is going into the same TSIM DB, so it will be very hard to get information where the data came from.

           

          there is some similar request Can we have TSIS details in events?  but if none of the above helps raise a support issue with BMC, i have not found any way of webservice or commandline to get such informatoin

          cheers

          rop