Working with Event Policies and Actions › Create an Event Policy with a Create Event Action › Create Event Action Examples

Create Event Action Examples

The following examples show how you can use the create event action to create new events when search patterns match:

Note: For detailed end-to-end scenarios that use the create event action, see Event Management Scenarios.

Example: Create new event to indicate a pattern of CPU usage spikes

This example creates a new event that summarizes a condition detected through event correlation: in this case, a pattern of CPU usage spikes on a system:

• Enter a search pattern in the Event Search tab similar to the first example in Event Search Examples: Occurrence Frequency, and click Search to obtain results for previewing the new event based on existing events.
• Change the following values in the Assigned Value column:
  • Set the Severity to Critical using the right-click menu.
  • Set the Summary to 'CPU Usage Spiking on ${pattern1.AlertedMdrElementID}.
  • Set the Severity Trend to Increasing.
  • mdrElementID: fx:uniqueidentifier()

  The created event inherits all other properties from the original events, with an elevated severity and a summary that clarifies the correlated condition.

• Deploy the policy on the Mid-tier connector to include events from all connectors in the policy, or on specific connectors only to limit the policy to those connectors.
• Create and deploy a separate filter action using the same search criteria to filter the original events.

Example: Create a new event when physical and virtual memory exceed a threshold within 60 seconds

This example creates a new event when the virtual and physical memory on a system each exceed 80% within a 60 second time span:

• Enter the following search patterns in the Event Search tab, select 'all events occurs within 60 seconds' in the Additional Criterion pane, and click Search to obtain results for previewing the new event based on existing events:
  • Pattern 1: AlertedMdrElementID=? and matches(Summary,'Physical Memory') and Severity='Major'
  • Pattern 2: AlertedMdrElementID=? and matches(Summary,'Virtual Memory') and Severity='Major'
• Change the following values in the Assigned Value column:
  • Severity: Critical
  • Summary: MEMORY SHORTAGE
  • Message: Symptom: ${pattern1.Summary} + ${pattern2.Summary}
  • mdrElementID: fx:uniqueidentifier()

  The created event inherits all other properties from the original events, with an elevated severity, a summary that clarifies the correlated condition, and a message that includes the summary of each original event.

• Deploy the policy on the Mid-tier connector to include events from all connectors in the policy, or on specific connectors only to limit the policy to those connectors.
• Create and deploy a separate filter action using the same search criteria to filter the original events.

Example: Create a new event when an expected backup stopped event does not occur after a backup started event

This example creates a new event when an expected event is not occurring. In this case, an event signifying the completion of a backup job should occur within 120 seconds after an event that signifies the start of a backup job. When the completion event does not occur, this example creates a new event that describes the condition:

• Enter the following search patterns in the Event Search tab, select 'ALL events occurs within 120 seconds' and Sequence enforced in the Additional Criterion pane, and click Search to obtain results for previewing the new event based on existing events:
  • Pattern 1: AlertedMdrElementID=? and matches(Summary,'Backup started')
  • Pattern 2: not(AlertedMdrElementID=? and matches(Summary,'Backup stopped'))
• On the Create New Event page, change the following values in the Assigned Value column:
  • Severity: Critical
  • Summary: BACKUP NOT COMPLETED IN TIME
  • mdrElementID: fx:uniqueidentifier()

  The created event inherits all other properties from the backup started event with an elevated severity and a summary that clarifies the condition implied by the missing backup completed event.

• Deploy the policy on the applicable connector to limit the policy to that connector.