Monitoring Event Rules
Monitoring event rules are used to process monitoring events. The system checks records in the Monitoring Event (itsm_event_rule) table against the event rule. If the records match the rule, the system starts counting down the revalidation period. At the end of this period, the system rechecks whether the monitoring event records match the event rule.
The revalidation period is not used for the Information events and if the Ignore event correlation checkbox is selected on the event rule form. This means that events that satisfy the conditions of the event rule immediately trigger the related actions.
If you select the Ignore event correlation checkbox, the actions are executed every time, regardless of whether they were previously executed for the event.
To create an event rule, complete the following steps:
- Navigate to Monitoring and Event Management → Configuration → Event Rules.
- Click New and fill in the fields.
- Click Save or Save and exit to apply the changes.
Monitoring Event Rule form fields
| Field | Mandatory | Description |
|---|---|---|
| Name | Y | Specify a name for the event rule. The name should be unique. |
| Description | N | Add a brief description. |
| Deactivate monitoring event | N | Specify the monitoring deactivation conditions. Available options:
The field determines whether it is possible to set the Event deactivation conditions in the Action for event rule. The selected option determines the influence of several records related to the Monitoring event to its deactivation. |
| Active | N | Select this checkbox to enable the rule. |
| Type | Y | Specify the event type. Available options:
|
| Message count | Y | Specify the number of the event messages required to execute the current rule. The field appears when the Information type is selected. |
| Message accumulation period | Y | Specify the period during which the number of event messages specified in the Message count field should be accumulated. The field appears when the Information type is selected. |
| Active event count | Y | Specify the number of active events in the Monitoring Events (itsm_monitoring_event) table for the rule to work. The field appears when the Warning type is selected. |
| Ignore event correlation | N | Select this checkbox to ignore the event correlation engine in cases when it is required to create an ITSM record without waiting for the event correlation to be processed. When the checkbox is selected:
When the checkbox is cleared, all related event rule actions with the Create record and set update script action type are deactivated. These actions cannot be manually activated until the checkbox is selected again. The field appears when the Exception type is selected. |
| Revalidation period | Y | Specify the time period after which the monitoring events will be rechecked for compliance with the rule. The field appears when the Warning or Exception type is selected. |
Action for Event Rule
When the event records are rechecked, and they still match the rule, the system performs all actions created for this event rule in ascending order.
To create an action, complete the following steps:
- Open the event rule record you need to create an action for.
- Navigate to the Related Lists area, select the Action for Event Rule tab.
- Click New and fill in the fields.
- Click Save or Save and exit to apply the changes.
You can also open the action form via the Navigator menu. To do this, navigate to Monitoring and Event Management → Configuration → Action Event Rules and click New. In this case, you need to fill in the Event rule field manually.
Action for Event Rule form fields
| Field | Mandatory | Description |
|---|---|---|
| Name | Y | Specify a name of the action. |
| Event rule | Y | Specify the event rule for which the action is created. |
| Action type | Y | Specify the action type. Available options:
|
| Table | Y | Specify the table in which the action should be performed. Only the tables inherited from ITSM Task (itsm_task) can be selected. The field appears when the Create record, Create record and set update script or Update predefined record action type is selected. |
| Record | Y | Specify the record that should be updated. The field appears when the Update predefined record action type is selected. |
| Template | N | Specify a column and define the value to be assigned when the action is triggered. Only the columns of the table specified in the Table field are available. The field is hidden when the Execute user script action type is selected. |
| Use script | N | Select the checkbox to display the Script field. When the Create record and set update script action type is selected, the title is changed to Record creation script. |
| Script | N | Enter a script using the SimpleOne Server-Side API. The field appears when the Use script checkbox is selected or when the Execute client script action type is selected. Use the executeScript() function with the following parameters, which are SimpleRecord objects:
|
| Record update script | N | Enter a script using the SimpleOne Server-Side API. The field appears when the Create record and set update script action type is selected. |
| Active | N | Select this checkbox to enable the action. |
| Order | N | Specify the action order. Actions are performed in the ascending order. |
Сonditions for event deactivation | N | Specify the conditions to set the Inactive state for the event when the monitoring event rule is triggered. The field appears when all of the following conditions are met:
|
When an action of the Create record, Update predefined record, or Create record and set update script type is performed, a new record is created in the ITSM Task Event (itsm_task_event) table. This record connects the ITSM Task (itsm_task) record to the Monitoring Event (itsm_monitoring_event) and Action for event rule (itsm_action_event_rule) records. If the binding record already exists, a new one is not created.
If the record from any ITSM Task child table has related Monitoring Event records, the relevant related list is displayed on its form.
Message processing
After setting up all the necessary elements (monitoring source, monitoring rules, monitoring event rules and actions, adding a system user with the monitoring_message_creator and import_admin roles), the system is ready to receive messages from the monitoring systems. When messages are received, SimpleOne analyzes them and, if necessary, performs the specified actions. For example, the system creates an infrastructure incident, updates the operational status of a CI, and others.
Deactivate the events
Each time an ITSM task is updated, it is checked against the Сonditions for event deactivation of the related action within which the task was created or updated.
If the conditions are met and the Deactivate monitoring event field in the related event rule has the One related record matches conditions option selected, the triggering monitoring event is deactivated.
If the All related records match conditions option is selected in the Deactivate monitoring event field of the related event rule, the monitoring event is deactivated only when all ITSM task records associated with the event meet the deactivation conditions.
- No labels
