Type
  • Best Practice
Description
  • This article describes how to change the default cell rule to close the Sentry class-41 events when class-9 events are generated.
Additional Keywords
  • BEM, BPPM, cell, Class 9, Class 11, Class 41, Events, MCELL, PATROL Agent

Related Topics

Knowledge Base

Closing Sentry Class-41 Events in BEM/BPPM when Class-9 Events are Generated

KB1141 - May 30, 2014

Description

Class-41 events are generated by the Sentry KMs, such as Hardware Sentry KM for PATROL and Monitoring Studio KM for PATROL, each time a threshold is exceeded. Contrary to the class-11 events that are generated by the PATROL Agent and that contain the bare minimum of the fault, the class-41 events contain the full health report by detailing the fault that has occurred.

When the alarm no longer exists, a class-9 event (STATE_CHANGE) is generated by the PATROL Agent and closes the class-11 event but the class-41 event remains open with the same severity. To automatically close the class-41 event when the class-9 event is generated, you need to modify the default cell rule.

Solution

Depending on your PATROL architecture, you will have to either modify the:

  • mcxp.mrl file (PATROL v.3)
  • or the bii4p.mrl file (PATROL v.7)

to make the default cell rule close the Sentry class-41 events.

Modifying the mcxp.mrl (PATROL V.3)

  1. Open the mcxp.mrl file located in MCELL_HOME/etc/<cellname>/kb/rules/
  2. Find the following line:
  3. $OLD.p_class  within [9,11,16,39, UpdParState]
  4. Add “41” to the line to have:
$OLD.p_class  within [9,11,16,39,41, UpdParState]

Here is the result as it will appear in the code:


#############################
## Indexed adapt_param_status
#############################

new adapt_param_status :
PATROL_EV($NEW)
where
[
#p_catalog:               within [0,STD,STANDARD],
p_class:       within [9,11,16,39,UpdParState]
]
using ALL
{
PATROL_IDX ($IDX)
where
[
$IDX.p_origin == $NEW.p_origin AND
$IDX.p_agent_port == $NEW.p_agent_port AND
$IDX.mc_host_address == $NEW.mc_host_address
]
PATROL_EV ($OLD)
where
[
$OLD.status !=  CLOSED AND
$OLD.mc_ueid == $IDX.PATROL_ueid AND
$OLD.p_class within [9,11,16,39, 41, UpdParState]
#AND $OLD.p_catalog within [0,STD,STANDARD]
]
}
triggers
{
$OLD.status = CLOSED ;
}
END

Modifying the bii4p.mrl file (PATROL V.7)

  1. Open the bii4p.mrl file located in MCELL_HOME/etc/<cellname>/kb/rules/
  2. Find the following line:
  3.         

    $OLD.p_class within [9,10, 11,12,16,39,UpdParState] AND

  4. Add “41” to the line to have:
  5.         

    $OLD.p_class within [9,10, 11,12,16,39,41,UpdParState] AND

    Here is the result as it will appear in the code:

            

    #######################
    ## Indexed adapt_param_status
    ######################

    new adapt_param_status :
    PATROL_EV($NEW)
    where [ $NEW.status != CLOSED AND $NEW.status != BLACKOUT AND
    $NEW.p_class_group == "param_group" AND
    $NEW.p_catalog == "STD" ]
    using ALL
    {
    PATROL_IDX ($IDX)
    where [ $IDX.p_origin == $NEW.p_origin AND
    $IDX.p_agent_port == $NEW.p_agent_port AND
    $IDX.mc_host_address ==$NEW.mc_host_address ]
    PATROL_EV ($OLD)
    where [ $OLD.status != CLOSED AND $OLD.status != BLACKOUT AND
    $OLD.mc_ueid == $IDX.PATROL_ueid AND
    $OLD.p_class within [9,10, 11,12,16,39,41,UpdParState] AND
    $OLD.p_catalog == "STD" ]
    }
    triggers
    {
    $OLD.status       = CLOSED ;
    }
    END

  6. Save the .mrl file.
  7. Run these commands on the machine where the cell is running:
  8.         

    Mccomp –n <cellname>
    Mcontrol –n <cellname> reload kb

  9. Generate new events of class 11, 41, and then 9.
  10. Check out the result in the Impact Explorer/BPPM Ops console.