Previous Topic: Policy Operations for the Alert Event ClassNext Topic: Normalize


Parse

You must parse the trap data for alerts similar to the way you did for trap-based CIs. Separating the varbind values lets you isolate the values for individual use in other sections of policy. For the Alert eventtype, add the parse operation to the Alert event class section of the policy file as follows:

<Catalog version="1.0" globalextends="GLOBAL!">
<!--  ======Event Class======   --> 
<EventClass name="Alert">
<Parse>
<Field input="snmp_varbindvals" output="temp_nodetype,temp_nodename,temp_domain,temp_applname,temp_applgen,temp_jobname,temp_jobequal,temp_state,temp_status" pattern="^(.*?),(.*?),(.*?),(.*?),(.*?),(.*?),(.*?),(.*?),(.*?)$" /> 
</Parse>
</EventClass>
</Catalog>

This policy takes the received comma-separated snmp_varbindvals property values and assigns them to individual property names according to their order of occurrence. For example, the first value is assigned to the temp_nodetype property, and second value is assigned to the temp_nodename property, and so on. After the value field is parsed and available, you can use the same information for uniquely identifying a specific alert.