Previous Topic: Policy Operations for the Item Event ClassNext Topic: Parse


Classify

You must classify traps that reach the policy as an Item eventtype to specific CI types. To do this, you must choose a property from the connector data output that you can use for classifying the CI. For this example, snmp_varbindoids has been chosen as the classifier. Write the Classify section of the sample policy as follows:

<Catalog version="1.0" globalextends="GLOBAL!">
<!-- ======Event Class====== --> 
<EventClass name="Item">
<!-- Classify --> 
<Classify>
<Field input="snmp_varbindoids" pattern=".*1\.3\.6\.1\.4\.1\.11203\.9.*$" output="eventtype" outval="ITActivity" />
</Classify>
</EventClass>
</Catalog>

This policy classifies traps defined under the Item eventtype as belonging to the ITActivity CI type when the value of the snmp_varbindoids property contains the pattern 1.3.6.1.4.1.11203.9.

For example, if the snmp_varbindoids value is 1.3.6.1.4.1.11203.1,1.3.6.1.4.1.11203.3,1.3.6.1.4.1.11203.11,1.3.6.1.4.1.11203.7,1.3.6.1.4.1.11203.8,1.3.6.1.4.1.11203.9,1.3.6.1.4.1.11203.10,1.3.6.1.4.1.11203.6,1.3.6.1.4.1.11203.5, the trap is classified to ITActivity, because it contains the specified 1.3.6.1.4.1.11203.9 pattern.

By default, all received traps in this example are considered to be of type ITActivity. Most detailed integrations require you to define multiple classification rules for multiple CI types (for example, ComputerSystem, Process, Database, and so on). Each CI type requires its own specialized processing operations. Because this example classifies all traps under one CI type, you define the ITActivity class as follows:

<Catalog version="1.0" globalextends="GLOBAL!">
<!-- ======Event Class====== --> 
<EventClass name="Item">
<!-- Classify --> 
<Classify>
<Field input="snmp_varbindoids" pattern=".*1\.3\.6\.1\.4\.1\.11203\.9.*$" output="eventtype" outval="ITActivity" />
</Classify>
</EventClass>
<!--  ======Event Class======   --> 
<EventClass name="ITActivity" extends="Item">
</EventClass>
</Catalog>

All processing operations specific to the ITActivity CI type occur within this EventClass definition.