Knowledge Base

Closing Sentry Class-41 Events in BEM/BPPM when Class-9 Events are Generated

KB1141 - May 30, 2014

Type: Best Practice

Description: This article describes how to change the default cell rule to close the Sentry class-41 events when class-9 events are generated.

Additional Keywords: BEM, BPPM, cell, Class 9, Class 11, Class 41, Events, MCELL, PATROL Agent

Related Topics

Description

Class-41 events are generated by the Sentry KMs, such as Hardware Sentry KM for PATROL and Monitoring Studio KM for PATROL, each time a threshold is exceeded. Contrary to the class-11 events that are generated by the PATROL Agent and that contain the bare minimum of the fault, the class-41 events contain the full health report by detailing the fault that has occurred.

When the alarm no longer exists, a class-9 event (STATE_CHANGE) is generated by the PATROL Agent and closes the class-11 event but the class-41 event remains open with the same severity. To automatically close the class-41 event when the class-9 event is generated, you need to modify the default cell rule.

Solution

Depending on your PATROL architecture, you will have to either modify the:

  • mcxp.mrl file (PATROL v.3)
  • or the bii4p.mrl file (PATROL v.7)

to make the default cell rule close the Sentry class-41 events.

Modifying the mcxp.mrl (PATROL V.3)

  1. Open the mcxp.mrl file located in MCELL_HOME/etc/<cellname>/kb/rules/
  2. Find the following line: 
    3. $OLD.p_class  within [9,11,16,39, UpdParState]
  3. Add “41” to the line to have: 
$OLD.p_class  within [9,11,16,39,41, UpdParState]

Here is the result as it will appear in the code:


#############################
## Indexed adapt_param_status
#############################

new adapt_param_status :
PATROL_EV($NEW)
where
[
#p_catalog:               within [0,STD,STANDARD],
p_class:       within [9,11,16,39,UpdParState]
]
using ALL
{
PATROL_IDX ($IDX)
where
[
$IDX.p_origin == $NEW.p_origin AND
$IDX.p_agent_port == $NEW.p_agent_port AND
$IDX.mc_host_address == $NEW.mc_host_address
]
PATROL_EV ($OLD)
where
[
$OLD.status !=  CLOSED AND
$OLD.mc_ueid == $IDX.PATROL_ueid AND
$OLD.p_class within [9,11,16,39, 41, UpdParState]
#AND $OLD.p_catalog within [0,STD,STANDARD]
]
}
triggers
{
$OLD.status = CLOSED ;
}
END

Modifying the bii4p.mrl file (PATROL V.7)

  1. Open the bii4p.mrl file located in MCELL_HOME/etc/<cellname>/kb/rules/
  2. Find the following line:
    3.         
    $OLD.p_class  within [9,10, 11,12,16,39,UpdParState] AND
  3. Add “41” to the line to have: 
    4.         
    $OLD.p_class  within [9,10, 11,12,16,39,41,UpdParState]  AND

    Here is the result as it will appear in the code:

            
    #######################
    
          ## Indexed adapt_param_status 
    
          ######################
    
        
    new adapt_param_status : 
    
          PATROL_EV($NEW) 
    
          where [ $NEW.status !=  CLOSED AND $NEW.status != BLACKOUT AND
    
          $NEW.p_class_group ==  "param_group" AND 
    
          $NEW.p_catalog == "STD" ]
    
          using ALL 
    
          { 
    
          PATROL_IDX ($IDX) 
    
          where [ $IDX.p_origin == $NEW.p_origin  AND 
    
          $IDX.p_agent_port == $NEW.p_agent_port AND
    
          $IDX.mc_host_address  ==$NEW.mc_host_address ]
    
          PATROL_EV ($OLD) 
    
          where [  $OLD.status != CLOSED AND $OLD.status != BLACKOUT AND
    
          $OLD.mc_ueid == $IDX.PATROL_ueid AND
    
          $OLD.p_class within [9,10, 11,12,16,39,41,UpdParState] AND 
    
          $OLD.p_catalog == "STD" ]
    
          }
    
          triggers
    
          {
    
          $OLD.status       = CLOSED ;
    
          }
    
          END
  4. Save the .mrl file.
  5. Run these commands on the machine where the cell is running: 
    6.         
    Mccomp –n  <cellname>
    
        Mcontrol –n <cellname> reload kb
  6. Generate new events of class 11, 41, and then 9.
  7. Check out the result in the Impact Explorer/BPPM Ops console.