12 Replies Latest reply on Jun 23, 2020 10:34 AM by Alvaro Paronuzzi

    MRL-Closing events at the end of the month

    Alvaro Paronuzzi
      Share This:

      Hello everyone,

       

      I have a customer requirement of closing a subset of events at the end of the month they arrived in.

       

      Example:

       

      if the event arrived on Mar 13th, it must be automatically closed on Mar 31st at 11:59 p.m.

      if the event arrived on Apr 25th, it must be automatically closed on Apr 30th at 11:59 p.m.

       

      It sounds a little bit tricky but maybe there is an MRL function that may help on this. How would you approach this?

       

      I am starting from the set_timer function. I'm on TSIM 10.7.

       

      Thank you in advance for any help you can provide.

       

      Kind Regards,

      Alvaro Paronuzzi

        • 1. Re: MRL-Closing events at the end of the month
          Brendan Murray

          Hi Alvaro,

           

          I would not use set_timer for this requirement. You would have the potential of running hundreds, perhaps thousands of timers concurrently for a long period of time. This consumes cell resources and could impact cell performance.

           

          First, I would recommend that your customer give some serious thought to their event management process. Leaving events open for long periods of time and then closing them on a schedule at the end of the month is not a best practice. Events should be open only as long as the condition that triggered them exists. If you have alerts that stay open for days or even months, it's time to re-evaluate your processes.

           

          Having said this, if you must meet your customer's requirement, I would use the Cell Tick event to trigger your event cleanup, not timer rules. The Cell Tick event is generated at a regular interval which is configured in mcell.conf. It is an internal cell event, so those events must be enabled. You can also change the cell tick interval if you wish. Both of these settings are found in mcell.conf. This documentation page describes their function.

           

          The cell tick event (class MC_CELL_TICK) is normally of INFO severity and is generated according to the CellTickInterval setting in mcell.conf. By default, it is configured to de-duplicate, so you will only see one active Cell Tick Event on your event display. The repeat counter will typically have a very high number, indicating how many Cell Tick events have arrived since the last time the cell was restarted.

           

          To close your events, you would configure your rule to be triggered by the Cell Tick event. I believe you will need to use the 'Execute' rule phase since the Cell Tick event is de-duplicated. You can trigger your rule based on the change to the repeat_count slot. Your rule would evaluate the time stamp of the event and, if it's 11:59 on the last day of the month, it would generate a custom 'CELL_CLEANUP' (or whatever name you choose) event. You would have a second rule of the 'New' phase which be triggered by the CELL_CLEANUP event. It would perform an Updates ALL on the events that need to be closed. Be aware that Updates All can consume significant cell resources. You should be as specific as possible with the where clause, i.e. only update specific classes, not the base EVENT class, if possible. Your rule would have to do the date arithmetic to determine which events to close. You probably should also use the within Timeframe clause to limit the scope of the search.

           

          I should add that I have not done this myself, but I believe it will work. Also, you can try creating a New rule to be directly triggered by the Cell Tick event. I believe it will not work due to the de-duplication, but there is no harm in testing this.

           

          Please let us know how you end up solving this problem. It will be helpful to others.

           

          Regards,

           

          Brendan

          • 2. Re: MRL-Closing events at the end of the month
            Alvaro Paronuzzi

            Hi Brendan,

             

            Thank you for your help. The solution seems quite complex so, as a first step, I will try to negotiate this requirement.

            Probably there is an easier approach that may lead to a similar behavior (in other words maybe the requirement may be slightly modified).

             

            Regards,

            Al

            • 3. Re: MRL-Closing events at the end of the month
              Alvaro Paronuzzi

              Hi Brendan,

               

              regarding the solution you suggested, how can I implement the "last day of the month" detection in MRL? This is the main aspect that I am completely missing.

               

              Thank you,

              Alvaro

              • 4. Re: MRL-Closing events at the end of the month
                Philippe Plomteux

                Alvaro,

                 

                You could use the following MRL :

                 

                 

                 

                $DayOfTheMonth=time_extract(time_stamp(),”day”);

                 

                 

                 

                If you trigger on a cell tick (as Brendan indicated this is better than set timers on each event) you could test that $DayOfTheMonth=1 to trigger the rest of your code.

                 

                 

                 

                Alternatively, you could also thing of using set_timer_at  on the cell tick and expire the timer at the end of the coming month

                 

                 

                 

                Enjoy

                 

                Philippe

                 

                 

                 

                 

                 

                 

                 

                De : Alvaro Paronuzzi <communities_update@bmc.com>

                Envoyé : mardi 16 juin 2020 15:29

                À : Philippe Plomteux <pplomteux@yahoo.com>

                Objet : Re:  - MRL-Closing events at the end of the month New message on BMC Communities

                 

                 

                 

                 

                 

                 

                <https://communities.bmc.com/> BMC Communities

                 

                 

                 

                MRL-Closing events at the end of the month

                 

                 

                reply from Alvaro Paronuzzi <https://communities.bmc.com/people/aparonuzzi?et=watches.email.thread>  in TrueSight Infrastructure Mgmt - View the full discussion <https://communities.bmc.com/message/876361?et=watches.email.thread#876361>

                1 of 1 people found this helpful
                • 5. Re: MRL-Closing events at the end of the month
                  Alvaro Paronuzzi

                  Thank you Philippe.

                  Technically speaking, what do you mean by "expire the timer at the end of the coming month"? My understanding is that the "milestone" for the timer expiration would depend on the current month. How does TrueSight know how long it will have to wait in order to close that event?

                   

                  In any case I will check the cell tick documentation and look for an example that may help me to understand how it works.

                   

                  Thank you,

                  Alvaro

                  • 6. Re: MRL-Closing events at the end of the month
                    Philippe Plomteux

                    Alvaro,

                     

                     

                     

                    If you know the current month using e.g. time_extract, you can add 1 to target the next month (just beware of December) then you can build a timestamp using str_to_time_stamp, then set a timer.

                     

                    There may be more direct routes but cannot check further now

                     

                     

                     

                    set_timer_at($EV,str_to_time_stamp(”20200701 00:01,'%Y%m%d %H:%M'),STARTCLEANUP)

                     

                     

                     

                    Alternatively, cron + mquery + msetmsg will do nicely as well  

                     

                     

                     

                    Philippe

                     

                     

                     

                     

                     

                     

                     

                     

                     

                    De : Alvaro Paronuzzi <communities_update@bmc.com>

                    Envoyé : mardi 16 juin 2020 16:01

                    À : Philippe Plomteux <pplomteux@yahoo.com>

                    Objet : Re:  - MRL-Closing events at the end of the month New message on BMC Communities

                     

                     

                     

                     

                     

                     

                    <https://communities.bmc.com/> BMC Communities

                     

                     

                     

                    MRL-Closing events at the end of the month

                     

                     

                    reply from Alvaro Paronuzzi <https://communities.bmc.com/people/aparonuzzi?et=watches.email.thread>  in TrueSight Infrastructure Mgmt - View the full discussion <https://communities.bmc.com/message/876410?et=watches.email.thread#876410>

                    • 7. Re: MRL-Closing events at the end of the month
                      Deepak Kamath

                      Create a enrichment policy or rule to update a custom slot with value for your requirement if this is specific to few events

                      eg : mc_timeout =monthend

                       

                      Create a cronjob or use any batch scheduler job to run every month end on these events. Use msetmsg  to update the slot status to closed or use mquery to delete

                       

                      This should be a easier way rather than cell waiting to timeout an event

                      • 8. Re: MRL-Closing events at the end of the month
                        Alvaro Paronuzzi

                        In the past few days I thought that an easier approach would involve the use of a timeframe (monthly), a selector and a closure policy.

                        I negotiated the requirement and it's ok now to close the event on 1 a.m. of the first day of the new month instead of closing it at the end of the current month.

                        I tested this solution but it's not working as expected. What I expected was to see all the open events in the cell belonging to the class added to the collector to be automatically closed during the defined timeframe window. Is my expectation correct?

                         

                        Deepak Kamath

                        Regarding your solution:

                        Is "monthend" reconized as a keyword?

                        Create a cronjob or use any batch scheduler job to run every month end on these events. Use msetmsg  to update the slot status to closed or use mquery to delete

                        I would really appreciate if you could share a simple example because I don't know exactly where to start...

                        My understanding is that I should schedule the events closure outside the cell (mrl/policy) for example by triggering an mquery to close the events defined inside a batch that has to be scheduled at os level. Is my understanding correct?

                         

                        Thanks and Regards,

                        Alvaro

                        • 9. Re: MRL-Closing events at the end of the month
                          Philippe Plomteux

                          Share the code ?

                           

                           

                           

                           

                           

                          De : Alvaro Paronuzzi <communities_update@bmc.com>

                          Envoyé : lundi 22 juin 2020 09:53

                          À : Philippe Plomteux <pplomteux@yahoo.com>

                          Objet : Re:  - MRL-Closing events at the end of the month New message on BMC Communities

                           

                           

                           

                           

                           

                           

                          <https://communities.bmc.com/> BMC Communities

                           

                           

                           

                          MRL-Closing events at the end of the month

                           

                           

                          reply from Alvaro Paronuzzi <https://communities.bmc.com/people/aparonuzzi?et=watches.email.thread>  in TrueSight Infrastructure Mgmt - View the full discussion <https://communities.bmc.com/message/877079?et=watches.email.thread#877079>

                          • 10. Re: MRL-Closing events at the end of the month
                            Alvaro Paronuzzi

                            In attachment the selector and the policy.

                            Below the screenshot of the Timeframe:

                             

                            Thank you!

                            Al

                            • 11. Re: MRL-Closing events at the end of the month
                              Philippe Plomteux

                              Alvaro,

                              Closure policies only trigger when events matching the selector ECF arrive. You cannot rely on the arrival of such an event. Use a tick.

                              You could try something like this , presuming your ticks arrive every minute and your TF has a short (2 minutes) duration :

                               

                              execute my rule:

                                  MC_CELL_TICK ($EV)

                              using ALL {  TIME_FRAME ($TF) where[ $TF.name == "SKL_TF_Monthly" AND tf_active($TF)]

                                                  SKL_EMAIL_EV($OLD) where [$EV.msg contains ''QuotaGuard'' AND $EV.status not_equals CLOSED ]

                                 }

                              when $EV.repeat_count

                              {

                              $OLD.status=CLOSED;

                              }

                              END

                               

                              Not sure how many events you expect every month as this could hurt performance.

                              But that should work

                              Philippe

                              1 of 1 people found this helpful
                              • 12. Re: MRL-Closing events at the end of the month
                                Alvaro Paronuzzi

                                Philippe,

                                Thank you for your help. I will give it a try and get back with the results.

                                I expect a low number of these events (< 20 per month).

                                Alvaro