Getting Notified When a Parameter is no Longer in Alert
KB1247 - Mar 19, 2019
Type: Best Practice
Description: How to configure Monitoring Studio X to get notified when a parameter that was previously in alert is back to an OK status.
Additional Keywords: Monitoring Studio X
Introduction
Monitoring Studio X can be configured to trigger a PATROL Event when a parameter that was previously in alert is back to an OK status.
Procedure
- From your Web browser, open the URL for the Monitoring Studio X Web interface (ex:
https://<patrol-agent>:<patrol-agent-port>/
). -
Open the Agent menu and the PATROL Agent Settings page.
-
In the Event Management section, set the Event Format Container to
BiiP4
and the Send the STD/41 Event to TrueSight to ON. -
Save your changes.
- Open the Studio menu.
-
From the left pane treeview, open the Studio Settings page.
-
Access the Alert Messages > PATROL Event section:
- set the Event Type to
Studio-specific (X_MAIN/Studio)
- Set the Acknowledge Event Type to
Studio-specific (X_MAIN/Ack)
. Monitoring Studio X will trigger this event type when a parameter that was previously in alert is back to an OK status - In the Acknowledge Event Content field, provide the message that will be sent along with the PATROL Event. The default acknowledge message is:
[ACK] - %{MESSAGE}
. The%{MESSAGE}
macro is configurable per class from Studio > Studio Settings > Default Message Content and can also be customized per alert type in the Monitor page under Parameters and Alerts
- set the Event Type to
-
On the Integration Service server, create the following rule for the cell where your PATROL Agent is routing events by default. Go to
MCELL_HOME/etc/<cellname>/kb/rules
and create asentry_msx.mrl
file which contains the following code:``` new Sentry_MSX_Ack : PATROL_EV ($NEW) where [ $NEW.status != CLOSED AND $NEW.status != BLACKOUT AND $NEW.p_class within [41,Studio,Ack]] updates PATROL_EV ($OLD) where [ $OLD.status != CLOSED AND $OLD.status != BLACKOUT AND $OLD.p_class within [41,Studio,Ack] AND $OLD.mc_object == $NEW.mc_object AND $OLD.mc_origin == $NEW.mc_origin AND $OLD.p_instance == $NEW.p_instance AND $OLD.p_origin == $NEW.p_origin] { $OLD.status = CLOSED; } END ```
-
Save this file in the
MCELL_HOME/etc/<cellname>/kb/rules
directory. -
Edit the .load file and specifiy that the sentry_msx rule must be processed before the mcxp/bii4p rule:
- Go to
MCELL_HOME\etc\<cellname>\kb\rules\
- Open the .load file in a text editor
- Locate the mcxp or bii4p line
-
Add the sentry_msx line above the mcxp or bii4p line
- Go to
-
Run the following command to recompile the cell:
mccomp –n <cellname>
. -
Restart the cell or run this command to reload kb:
mcontrol –n <cellname> reload kb
.Note: It is implied that, at this stage, you already have a rule/policy which propagates PATROL_EV from the IS' to the TSOM's main cell.
The Acknowledge PATROL Event and its associated message will be displayed in the Event page of the Monitoring Studio X Web interface.