Manually Refining Event Policy › How to Manually Refine Event Policy

How to Manually Refine Event Policy

When you, as an administrator, require a functionality for an event policy that the Event Policy dialog does not support, you can manually refine event policy files. Examples of situations that require manual event policy customization are as follows:

• Policies that require a combination of exclude and include filters
• Policies with an enrichment action that requires complex querying and enrichment assignments, involving operations such as SQL joins
• Policies that require more than three distinct search patterns
• Enrichment policies that are conditional based on the presence of certain event values

Unless one of these or another unsupported use case occurs, always use the functionality provided in the Event Policy dialog to define and deploy event policies.

To manually refine event policy, you must edit or create the appropriate event policy files using the <Evaluate> policy operation and embedded Drools rules.

Use this scenario to guide you through the process:

1. Create the basic framework for the event policy in the Event Policy dialog, omitting the part of the policy not supported by the user interface. For example, if you want to create a policy with multiple filters, create the policy with the correct search patterns and the initial filter in the Event Policy dialog so that the basic framework is in place for you to refine.

   Note: You can create a custom event policy without first using the user interface, but the effort required and margin for error increases significantly.

2. Deploy the policy from the user interface to the appropriate connectors. You must deploy the policy for the event policy file to be created.
3. Make a backup copy of the deployed policy file stored in one of the SOI_HOME\resources\Core\Catalogpolicy\extensions directory on the connector system, and copy the backup to a separate directory on your system.

   The deployed policy file is named according to the policy file name of the deployed connector and the event policy name (for example, sampleconnector_policy.service crash.xml).

4. Open the active version of the deployed policy file and make the necessary refinements.

   Rule evaluations and actions must adhere to the supported syntax for the Evaluate policy operation and the Drools language.

   Note: Do not edit the similar file located at SOI_HOME\resources\EventManagement\Policies on the SA Manager. This file records the user interface policy selections. After you edit the deployed policy file, the SOI_HOME\resources\EventManagement\Policies file is out of date and obsolete.

5. Copy the edited policy file to the SOI_HOME\resources\EventManagement\externalPolicies directory on the SA Manager system, change the file extension from '.xml' to '.policy', and change the file name so that it matches the name of the corresponding file in the SOI_HOME\resources\EventManagement\Policies directory.

   Policies either created or refined manually must exist in this directory, so that the Event Policies dialog recognizes them as manually created or refined policies. The policy now appears under External Policies in the Events tab. Any time you edit a policy file and move the corresponding SA Manager record of that policy to the externalPolicies directory, it appears as an external policy in the user interface.

6. Right click the policy, select Deploy Policy, select the connectors on which to deploy, and click OK.

   The updated policy redeploys.

7. Verify or test that the policy is working correctly.