Normalize
In the parsing section, the job state property temp_state that you created from a specific trap varbind value represents the severity level of the trap. The severity for CA Workload Automation traps may be one of the following:
You must map these severities to the CA SOI severity property using the Normalize operation. Normalize operations transform the syntax of event property values to give values from all sources a uniform nomenclature. For performing these mappings, write the Normalize section as follows:
<Catalog version="1.0" globalextends="GLOBAL!">
<!-- ======Event Class====== --> <EventClass name="Alert"> <Parse>
<Field input="snmp_varbindvals" output="temp_nodetype,temp_nodename,temp_domain,temp_applname,temp_applgen,temp_jobname,temp_jobequal,temp_state,temp_status" pattern="^(.*?),(.*?),(.*?),(.*?),(.*?),(.*?),(.*?),(.*?),(.*?)$" />
</Parse> <Normalize>
<Field input="temp_state" type="map" output="severity"> <mapentry mapin="[Uu][Nn][Kk][Nn][Oo][Ww][Nn]" mapout="Unknown" /> <mapentry mapin="[Cc][Oo][Mm][Pp][Ll][Ee][Tt][Ee]" mapout="Normal" /> <mapentry mapin="[Mm][Oo][Nn][Ii][Tt][Oo][Rr]" mapout="Normal" /> <mapentry mapin="[Ee][Xx][Ee][Cc]" mapout="Normal" /> <!-- Informational --> <mapentry mapin="[Ff][Aa][Ii][Ll][Ee][Dd]" mapout="Critical" /> <mapentry mapin="[Pp][Rr][Ee][Mm][Aa][Tt][Uu][Rr][Ee] [Ee][Nn][Dd]" mapout="Critical" /> <mapentry mapin="[Ii][Nn][Aa][Cc][Tt][Ii][Vv][Ee]" mapout="Minor" /> <mapentry mapin="[Oo][Vv][Ee][Rr][Dd][Uu][Ee]" mapout="Major" /> <mapentry mapin="[Ss][Uu][Bb][Ee][Rr][Rr][Oo][Rr]" mapout="Major" /> <mapentry mapin="[Aa][Gg][Ee][Nn][Tt] [Dd][Oo][Ww][Nn]" mapout="Critical" /> <!-- Fatal --> <mapentry mapin="[Rr][Ee][Aa][Dd][Yy]" mapout="Normal" /> <mapentry mapin="[Aa][Bb][Aa][Nn][Dd][Oo][Nn] [Ss][Uu][Bb][Mm][Ii][Ss][Ss][Ii][Oo][Nn]" mapout="Unknown" /> </Field>
</Normalize> </EventClass>
</Catalog>
This policy maps all potential values of the temp_state property to severities that CA SOI can understand. For example, Complete maps to Normal, Failed maps to Critical, Inactive maps to Major, and so on. Now, when you map this property value to the Severity USM property, it can understand and display the supported severity values.
|
Copyright © 2013 CA.
All rights reserved.
|
|