Format
Format operations combine property values into a new or existing property using a specified format. You can use format operations to define information in events received from event sources using a new property and adhering to a specified format.
For this example, you transform the source properties and the temporary properties that you create using the Parse operation into USM properties as follows:
<Catalog version="1.0" globalextends="GLOBAL!">
<!-- ======Event Class====== --> <EventClass name="Item"> <!-- Classify --> <Classify>
<Field input="snmp_varbindoids" pattern=".*1\.3\.6\.1\.4\.1\.11203\.9.*$" output="eventtype" outval="ITActivity" />
</Classify> <Parse>
<Field input="snmp_varbindvals" output="temp_nodetype,temp_nodename,temp_domain,temp_applname,temp_applgen,temp_ jobname,temp_jobequal,temp_state,temp_status" pattern="^(.*?),(.*?),(.*?),(.*?),(.*?),(.*?),(.*?),(.*?),(.*?)$" />
</Parse> <Format>
<!-- Non-Correlatable properties -->
<Field output="MdrElementID" format="{0}" input="AlertedMdrElementID" />
</Format>
This policy assigns the mandatory MdrElementID property to the CI based on the value of the AlertedMdrElementID in the alert created from the same trap. You assign the AlertedMdrElementID value in the format section for alerts. This value determines whether a CI is created for the trap. If the MdrElementID exists, the CI creation does not occur, and only an alert is created for the trap. For more information about assigning values for the AlertedMdrElementID property, see Format for the alert type.
</EventClass> <!-- ======Event Class====== --> <EventClass name="ITActivity" extends="Item"> <Normalize>
<Field input="temp_state" type="map" output="activityState"> <mapentry mapin="[Uu][Nn][Kk][Nn][Oo][Ww][Nn]" mapout="Unknown" /> <mapentry mapin="[Cc][Oo][Mm][Pp][Ll][Ee][Tt][Ee]" mapout="Finished" /> <mapentry mapin="[Mm][Oo][Nn][Ii][Tt][Oo][Rr]" mapout="Normal" /> <mapentry mapin="[Ee][Xx][Ee][Cc]" mapout="Normal-Running" /> <!-- Informational --> <mapentry mapin="[Ff][Aa][Ii][Ll][Ee][Dd]" mapout="Trouble" /> <mapentry mapin="[Pp][Rr][Ee][Mm][Aa][Tt][Uu][Rr][Ee] [Ee][Nn][Dd]" mapout="Obstructed" /> <mapentry mapin="[Ii][Nn][Aa][Cc][Tt][Ii][Vv][Ee]" mapout="Normal-Waiting" /> <mapentry mapin="[Oo][Vv][Ee][Rr][Dd][Uu][Ee]" mapout="Obstructed" /> <mapentry mapin="[Ss][Uu][Bb][Ee][Rr][Rr][Oo][Rr]" mapout="Finished-Completed" /> <mapentry mapin="[Aa][Gg][Ee][Nn][Tt] [Dd][Oo][Ww][Nn]" mapout="Trouble" /> <!-- Fatal --> <mapentry mapin="[Rr][Ee][Aa][Dd][Yy]" mapout="Normal" /> <mapentry mapin="[Aa][Bb][Aa][Nn][Dd][Oo][Nn] [Ss][Uu][Bb][Mm][Ii][Ss][Ss][Ii][Oo][Nn]" mapout="Finished-Abandoned" /> </Field>
</Normalize> <Format>
<!-- Correlatable properties, must populate at least one -->
<Field output="ActivityID" format="{0}" input="temp_jobname" />
<Field conditional="snmp_agent" output="DeviceIPV4Address" format="{0}" input="snmp_agent" />
<!-- verify that at least one property is set -->
<Field conditional="DeviceIPV4Address" output="temp_atleastoneset" format="{0}" input="DeviceIPV4Address" />
<Field conditional="!temp_atleastoneset" output="Error" format="At least one correlatable property is not set" input="" />
<!-- Non-Correlatable properties -->
<Field output="RuntimeName" format="{0}.{1}.{2}" input="temp_applname,temp_applgen,temp_jobname" />
<Field output="RuntimeDiscriminator" format="{0}" input="temp_applgen" />
<Field output="DefinitionName" format="{0}.{1}" input="temp_applname,temp_jobname" />
<Field output="ActivityTypes" format="Job" input="" />
<Field conditional="activityState" output="ActivityState" format="{0}" input="activityState" />
<Field conditional="temp_state" output="StateDescription" format="{0} present status is {1}" input="temp_jobname,temp_state" />
</Format> </EventClass>
</Catalog>
This policy does the following:
|
Copyright © 2013 CA.
All rights reserved.
|
|