Highlighted
Super Contributor.
Super Contributor.
648 views

Use sourceObjectName for specific enrichment at Managenet Events

Hi all,

I want to do an Enrichment at the BufferOutOfRangeOrMalfunctioning Management Event.

Specifically I want to alter the Severity to Minor if the Source Object is Small Buffers or Medium Buffers.

I see that the variable $sourceObjectName has to be used for the filtering in the Payload Filter.

So I tried a filter with cia.name=cia.sourceObjectName but got no matches.

What i have to correct in order to have a match???

Thank you in advance,

Costas

0 Likes
8 Replies
Highlighted
Acclaimed Contributor.. Acclaimed Contributor..
Acclaimed Contributor..

Re: Use sourceObjectName for specific enrichment at Managenet Events

Hello Costas,

 

did you try this:

 

ciaName=cia.sourceObjectName AND ciaValue=Small Buffers

 

HTH and kind regards

 

Allessandro

0 Likes
Highlighted
Super Contributor.
Super Contributor.

Re: Use sourceObjectName for specific enrichment at Managenet Events

Hi Alessandro,

Yes, that is exactly what I have tried, but no match.

Did I do something wrong?

Costas

0 Likes
Highlighted
Acclaimed Contributor.. Acclaimed Contributor..
Acclaimed Contributor..

Re: Use sourceObjectName for specific enrichment at Managenet Events

Hello Costas,

 

this should work. Can you please post a scrennshot of the custom incident attributes and of your definition of the payload filter for enrichment?

 

 

BR Allessandro

 

0 Likes
Highlighted
Super Contributor.
Super Contributor.

Re: Use sourceObjectName for specific enrichment at Managenet Events

Hi Alessandro,

I am attaching the screenshots.

Costas

0 Likes
Highlighted
Acclaimed Contributor.. Acclaimed Contributor..
Acclaimed Contributor..

Re: Use sourceObjectName for specific enrichment at Managenet Events

Hello Costas,

 

I have to see the custom incident attributes from the analysis pane when you have selected the incident. Can you please screenshot that tab?

 

Thanks and kind regards

 

Allessandro

0 Likes
Highlighted
Super Contributor.
Super Contributor.

Re: Use sourceObjectName for specific enrichment at Managenet Events

Hi Alessandro,

From the Analysis pane you can see the SNMP Object ID and the Message Format.

Nevertheless I am attaching the screenshot.

Did I get it wrong?

Costas

 

 

0 Likes
Highlighted
Acclaimed Contributor.. Acclaimed Contributor..
Acclaimed Contributor..

Re: Use sourceObjectName for specific enrichment at Managenet Events

Hello Costas,

 

not exaclty what I need as I am talking about an existing incident and not the incident configuration. But I think I have found the reason. I have checked some of my Management Events (incidents) and the sourceObject is NOT a custom incident attribute (here Node Down):

 

com.hp.ov.nms.apa.symptom (String) NodeUnmanagable
cia.snmpoid (String) .1.3.6.1.4.1.11.2.17.19.2.0.32
cia.reasonClosed (String) NodeUp
cia.timeIncidentDetectedMs (String) 1525316691340
cia.timeIncidentResolvedMs (String) 1525317260266
cia.incidentDurationMs (String) 568926

 

The sourceObjectName is not in that list (here it would have the value of the node). So you cannot use it as a Payload filter. In addition to this the Enrichment tab does not have an option to filter on the source Object.

 

Only solution seems to be to call an action script wich generates a new trap or thats sets the severity of that incident to a new value (based on $sourceObjectName as variable to the script - this should be possible using the NNMi web services).

 

HTH and kind regards

 

Allessandro

0 Likes
Highlighted
Super Contributor.
Super Contributor.

Re: Use sourceObjectName for specific enrichment at Managenet Events

Hi Alessandro,

You are correct. The cia.sourceObjectName is NOT in the Custom Attributes list of the Incident.

I am wondering why, because the ability to filter events based on that attribute is extremely useful.

I was hoping that I could avoid scripting, but I prooved wrong!

Nevertheless, thank you for your time and help.

Best Regards,

Costas

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.