Monitoring Event Rules


Monitoring event rules are used to process monitoring events. The system checks records in the Monitoring Event (itsm_event_rule) table against the event rule. If the records match the rule, the system starts counting down the revalidation period. At the end of this period, the system rechecks whether the monitoring event records match the event rule.

The revalidation period is not used for the Information events and if the Ignore event correlation checkbox is selected on the event rule form. This means that events that satisfy the conditions of the event rule immediately trigger the related actions.

If you select the Ignore event correlation checkbox, the actions are executed every time, regardless of whether they were previously executed for the event.

To create an event rule, complete the following steps:

  1. Navigate to Monitoring and Event Management → Configuration → Event Rules.
  2. Click New and fill in the fields.
  3. Click Save or Save and exit to apply the changes.

Monitoring Event Rule form fields

FieldMandatoryDescription
NameYSpecify a name for the event rule. The name should be unique.
DescriptionNAdd a brief description.
Deactivate monitoring eventN

Specify the monitoring deactivation conditions. Available options:

  • --None--
  • One related record matches conditions
  • All related records match conditions

The field determines whether it is possible to set the Event deactivation conditions in the Action for event rule. The selected option determines the influence of several records related to the Monitoring event to its deactivation.

ActiveNSelect this checkbox to enable the rule.
TypeY

Specify the event type. Available options:

  • Information responds to a sequence of informational messages associated with non-critical events. For example, consecutive errors occurred during the user authentication in a short time. 
  • Warning – indicates whether one of the service or device parameters has reached a threshold value.
  • Exception – determines whether a metric for a service or a system component has reached a specified breach value.
Message countY

Specify the number of the event messages required to execute the current rule. 

The field appears when the Information type is selected.

Message accumulation periodY

Specify the period during which the number of event messages specified in the Message count field should be accumulated. 

The field appears when the Information type is selected.

Active event countY

Specify the number of active events in the Monitoring Events (itsm_monitoring_event) table for the rule to work.

The field appears when the Warning type is selected.

Ignore event correlationN

Select this checkbox to ignore the event correlation engine in cases when it is required to create an ITSM record without waiting for the event correlation to be processed.

When the checkbox is selected:

  • All actions related to this event rule are performed each time the number of messages in the monitoring event is updated.
  • The Create record and set update script action type becomes available in the Action type field of the Action for Event Rule form.

When the checkbox is cleared, all related event rule actions with the Create record and set update script action type are deactivated. These actions cannot be manually activated until the checkbox is selected again.

The field appears when the Exception type is selected.

Revalidation periodY

Specify the time period after which the monitoring events will be rechecked for compliance with the rule.

The field appears when the Warning or Exception type is selected.

Action for Event Rule


When the event records are rechecked, and they still match the rule, the system performs all actions created for this event rule in ascending order. 

To create an action, complete the following steps:

  1. Open the event rule record you need to create an action for.
  2. Navigate to the Related Lists area, select the Action for Event Rule tab.
  3. Click New and fill in the fields.
  4. Click Save or Save and exit to apply the changes.

You can also open the action form via the Navigator menu. To do this, navigate to Monitoring and Event Management → Configuration → Action Event Rules and click New. In this case, you need to fill in the Event rule field manually. 

Action for Event Rule form fields

FieldMandatoryDescription
NameYSpecify a name of the action.
Event ruleY

Specify the event rule for which the action is created. 

Action typeY

Specify the action type. Available options:

  • Create record – a record is created in the specified Table.
  • Update predefined recordthe specified Record is updated according to the Template and Script.
  • Execute user script – the specified Script is executed.
  • Create record and set update script – a record is created in the specified Table. When the rule action is repeated in response to the same event, the target Table record is updated using the Record update script.
TableY

Specify the table in which the action should be performed. Only the tables inherited from ITSM Task (itsm_task) can be selected.

The field appears when the Create record, Create record and set update script or Update predefined record action type is selected.

RecordY

Specify the record that should be updated. 

The field appears when the Update predefined record action type is selected.

TemplateN

Specify a column and define the value to be assigned when the action is triggered. Only the columns of the table specified in the Table field are available.

The field is hidden when the Execute user script action type is selected.

Use scriptN

Select the checkbox to display the Script field.

When the Create record and set update script action type is selected, the title is changed to Record creation script.

ScriptN

Enter a script using the SimpleOne Server-Side API

The field appears when the Use script checkbox is selected or when the Execute client script action type is selected.

Use the executeScript() function with the following parameters, which are SimpleRecord objects:

  • event – the record in the Monitoring Event (itsm_monitoring_event) table that is created by the monitoring rule with the lowest order and is related to the current monitoring event rule.
  • message – the last record in the Target Message table related to the event.
  • record – the record that is specified in the Record field or created in the specified Table. If the Execute client script type is selected, the record is null.  
Record update scriptN

Enter a script using the SimpleOne Server-Side API

The field appears when the Create record and set update script action type is selected.

ActiveNSelect this checkbox to enable the action.
OrderNSpecify the action order. Actions are performed in the ascending order.

Сonditions for event deactivation

N

Specify the conditions to set the Inactive state for the event when the monitoring event rule is triggered.

The field appears when all of the following conditions are met:

  • One of the following options is selected in the Deactivate monitoring event field of the monitoring event rule related to the current action:
    • One related record matches conditions
    • All related records match conditions
  • The Table field is filled.
  • One of the following options is selected in the Action type field:
    • Create record
    • Update predefined record
    • Create record and set update script

When an action of the Create record, Update predefined record, or Create record and set update script type is performed, a new record is created in the ITSM Task Event (itsm_task_event) table. This record connects the ITSM Task (itsm_task) record to the Monitoring Event (itsm_monitoring_event) and Action for event rule (itsm_action_event_rule) records. If the binding record already exists, a new one is not created.

If the record from any ITSM Task child table has related Monitoring Event records, the relevant related list is displayed on its form.

Message processing


After setting up all the necessary elements (monitoring source, monitoring rules, monitoring event rules and actions, adding a system user with the monitoring_message_creator and import_admin roles), the system is ready to receive messages from the monitoring systems. When messages are received, SimpleOne analyzes them and, if necessary, performs the specified actions. For example, the system creates an infrastructure incident, updates the operational status of a CI, and others.

Deactivate the events

Each time an ITSM task is updated, it is checked against the Сonditions for event deactivation of the related action within which the task was created or updated.

If the conditions are met and the Deactivate monitoring event field in the related event rule has the One related record matches conditions option selected, the triggering monitoring event is deactivated.

If the All related records match conditions option is selected in the Deactivate monitoring event field of the related event rule, the monitoring event is deactivated only when all ITSM task records associated with the event meet the deactivation conditions.

  • No labels