Closing Sentry Class-41 Events in BEM/BPPM when Class-9 Events are Generated
KB1141 - May 30, 2014
Type: Best Practice
Description: This article describes how to change the default cell rule to close the Sentry class-41 events when class-9 events are generated.
Additional Keywords: BEM, BPPM, cell, Class 9, Class 11, Class 41, Events, MCELL, PATROL Agent
Description
Class-41 events are generated by the Sentry KMs, such as Hardware Sentry KM for PATROL and Monitoring Studio KM for PATROL, each time a threshold is exceeded. Contrary to the class-11 events that are generated by the PATROL Agent and that contain the bare minimum of the fault, the class-41 events contain the full health report by detailing the fault that has occurred.
When the alarm no longer exists, a class-9 event (STATE_CHANGE) is generated by the PATROL Agent and closes the class-11 event but the class-41 event remains open with the same severity. To automatically close the class-41 event when the class-9 event is generated, you need to modify the default cell rule.
Solution
Depending on your PATROL architecture, you will have to either modify the:
- mcxp.mrl file (PATROL v.3)
- or the bii4p.mrl file (PATROL v.7)
to make the default cell rule close the Sentry class-41 events.
Modifying the mcxp.mrl (PATROL V.3)
- Open the mcxp.mrl file located in MCELL_HOME/etc/<cellname>/kb/rules/
- Find the following line:
- Add “41” to the line to have:
$OLD.p_class within [9,11,16,39, UpdParState]
$OLD.p_class within [9,11,16,39,41, UpdParState]
Here is the result as it will appear in the code:
#############################
## Indexed adapt_param_status
#############################
new adapt_param_status :
PATROL_EV($NEW)
where
[
#p_catalog: within [0,STD,STANDARD],
p_class: within [9,11,16,39,UpdParState]
]
using ALL
{
PATROL_IDX ($IDX)
where
[
$IDX.p_origin == $NEW.p_origin AND
$IDX.p_agent_port == $NEW.p_agent_port AND
$IDX.mc_host_address == $NEW.mc_host_address
]
PATROL_EV ($OLD)
where
[
$OLD.status != CLOSED AND
$OLD.mc_ueid == $IDX.PATROL_ueid AND
$OLD.p_class within [9,11,16,39, 41, UpdParState]
#AND $OLD.p_catalog within [0,STD,STANDARD]
]
}
triggers
{
$OLD.status = CLOSED ;
}
END
Modifying the bii4p.mrl file (PATROL V.7)
- Open the bii4p.mrl file located in MCELL_HOME/etc/<cellname>/kb/rules/
- Find the following line:
- Add “41” to the line to have:
- Save the .mrl file.
- Run these commands on the machine where the cell is running:
- Generate new events of class 11, 41, and then 9.
- Check out the result in the Impact Explorer/BPPM Ops console.
$OLD.p_class within [9,10, 11,12,16,39,UpdParState] AND
$OLD.p_class within [9,10, 11,12,16,39,41,UpdParState] AND
Here is the result as it will appear in the code:
#######################
## Indexed adapt_param_status
######################new adapt_param_status :
PATROL_EV($NEW)
where [ $NEW.status != CLOSED AND $NEW.status != BLACKOUT AND
$NEW.p_class_group == "param_group" AND
$NEW.p_catalog == "STD" ]
using ALL
{
PATROL_IDX ($IDX)
where [ $IDX.p_origin == $NEW.p_origin AND
$IDX.p_agent_port == $NEW.p_agent_port AND
$IDX.mc_host_address ==$NEW.mc_host_address ]
PATROL_EV ($OLD)
where [ $OLD.status != CLOSED AND $OLD.status != BLACKOUT AND
$OLD.mc_ueid == $IDX.PATROL_ueid AND
$OLD.p_class within [9,10, 11,12,16,39,41,UpdParState] AND
$OLD.p_catalog == "STD" ]
}
triggers
{
$OLD.status = CLOSED ;
}
END
Mccomp –n <cellname>
Mcontrol –n <cellname> reload kb
Related Topics
- BPPM Group View: Monitors not Displayed in Tree Views
- Class-41 Events not Sent to Cell After Upgrading PATROL Agent to v9.5
- Deduplicating PATROL Events with Different mc_origin_key Slot Values
- Empty Values for mc_object_class, mc_object and mc_parameter Slots in the Sentry KMs’ Events
- Enriching PATROL Events with More Meaningful Information
- Generating Test Events with Hardware Sentry KM for PATROL
- Handling PATROL Events of Class 11/41
- Hardware Monitoring: Modifying the Maximum Number of Hosts
- High CPU and PATROL Crash Issues after loading Hardware Sentry KM
- How NetApp Filers KM for PATROL Reports 'Failed’ and ‘Degraded’ Status Values in the PATROL Console
- How to Manually Set Agent Thresholds in a CMA Policy
- Infinite Loop Reported in the PATROL Agent Log or System Output Window
- Integrating the Events Generated by the KMs into BMC Event Manager
- Integrating the Sentry Software's KMs into BMC ProactiveNet Performance Management (BPPM)
- Problem: Missing Sentry Software's KMs in BPPM CMA Monitoring Repository
- The user name or password is incorrect Message Appears in PATROL Agent Error Log
- Too Many Hardware Sentry Internal Events Generated in TrueSight/PATROL Consoles
- Troubleshooting Missed Events
- Unable to Load the Sentry’s KMs when Using PATROL Agent v.9.0.00
- Updating the mc_host and mc_host_address Slots of Sentry Class-41 Events in BEM with the Actual Hostname and IP Address of the Remotely Monitored System
- Using Macros to Customize PATROL Event Alert Actions