Writing Connector Policy › Policy Operations › Evaluate Operation

Evaluate Operation

Evaluate is the policy operation that enables correlations and actions. It evaluates streams of events against defined rules and runs workflow actions when the rules are met. You can write evaluate operations to automate intelligent actions in response to one or more event conditions that require more acknowledgment or action than a simple resolution.

Some of the examples where you can use the Evaluate operation are as follows:

• You can write a rule that detects if a source (SNMP, application log, and so on) generates three events reporting poor response time in a ten minute interval and creates a new event with a higher severity than the previous events that indicates a consistently poor response time.
• You can write rules to infer a clear event for low-level event sources that do not contain this mechanism. For example, an exception from an application log may not have the ability to clear a previously logged exception. You can write a rule for these exceptions to detect symptoms that the exception has been resolved and send a true clear alert to the event destination.
• You can write rules to associate events being sent to CA SOI as infrastructure alerts with the appropriate CI type. For example, you can write a rule to detect multiple events that indicate a database problem (where one event would not make this clear) and map the events to a Database CI.

You write evaluate operations in policy, but the operations rely on the Drools language, which adheres to a different format and must be inserted in the evaluate operation. For more information about writing Drools event-based rules and workflow actions, see the following page for Drools documentation (version 5): http://www.jboss.org/drools/documentation.html.

The Event Policies dialog in the Operations Console provides an interface for defining event actions such as correlation, enrichment, filtering, and event creation that are automatically converted to the Drools language. Writing evaluate operations directly in policy files is only necessary if your action is not possible through the Event Policies dialog.

Note: For more information about writing event policies and actions in the Operations Console, see the Event and Alert Management Best Practices Guide.