Parse
In the received CA Workload Automation traps, a single property, snmp_varbindvals, represents various individual properties (such as nodetype, nodename, state, and so on) as comma-separated values. To isolate all of these individual property values from the snmp_varbindvals property so that you can map them to individual USM properties, you must use the Parse operation. Parse operations split event properties into additional properties using regular expression subgroups.
For this example, the trap varbind data is parsed into meaningful properties in the policy file that can later be mapped to USM properties. Write the Parse section for the Item event class as follows:
Note: The ITActivity class inherits the same parse information from the parent Item class.
<Catalog version="1.0" globalextends="GLOBAL!">
<!-- ======Event Class====== --> <EventClass name="Item"> <!-- Classify --> <Classify>
<Field input="snmp_varbindoids" pattern=".*1\.3\.6\.1\.4\.1\.11203\.9.*$" output="eventtype" outval="ITActivity" />
</Classify> <Parse>
<Field input="snmp_varbindvals" output="temp_nodetype,temp_nodename,temp_domain,temp_applname,temp_applgen,temp_jobname,temp_jobequal,temp_state,temp_status" pattern="^(.*?),(.*?),(.*?),(.*?),(.*?),(.*?),(.*?),(.*?),(.*?)$" />
</Parse> </EventClass> <!-- ======Event Class====== --> <EventClass name="ITActivity" extends="Item"> </EventClass>
</Catalog>
This policy takes the received comma-separated snmp_varbindvals property values and assigns them to individual property names according to their order of occurrence. For example, the first value is assigned to the temp_nodetype property, and second value is assigned to the temp_nodename property, and so on. After the value field is parsed and available, you can use the same information for uniquely identifying a specific CI or alert.
|
Copyright © 2013 CA.
All rights reserved.
|
|