DX Unified Infrastructure Management

Hello, 

Would like your help on how to enrich alarm coming from websphere_mq probe.

The alarm is on an mq channel, and it is showing the status code of the channel.

I would like to replace that code with a text or add the text to one of the custom fields.

The alarm look like this: 

QOS_CHANNEL_CHANNEL_STATUS = 5.0 from source tsttux2.test.tase.co.il targeting MQ.TEST.REZEF.BOFFICE/TO.BOFFICE.2270 has crossed the critical static threshold of !=3.0

and would like to replace the 5.0 value with a text (for example: "retrying")

I am trying to do this with the alarm_enrichment.

i tried doing it with a script, and it worked ,but it causing me some problems with the soi intgration because the alarm is created with the code and then being changed and this is not so good...  so i thought using the alarm enrichment but it is not going so well...

attaching a screen shot from dr. nimbus with the detailed of the alarm.

any help will be greatly appreciated !!.

Thank you, 

Amit.

Hello Amit, so just for my understanding you say the Alarm is pubished into SOI before it gets enriched in UIM ? Can you please attach a screenshot of the Alert in SOI itself ?

Thanks,

Britta Hoffner

Hi Britta, 

When i used the lua script to update the alarm, then the alarm is created in UIM and the connector sends it to SOI.

meanwhile, the script runs in UIM and update the alarms which causes the alarm to update is SOI.

Up to here everything is good.... BUT, when the alarm first arrived to SOI, it also triggered the escalation action which sends it by mail or sms, so it got sent before it was updated....

it all happens very quickly, so a screenshot is hard to make...

Hello again, 

I solved half the problem.... 

First, I created a table in the DB that contain the codes and the text...

then i added this into the alarm enrichment in the nas.cfg:

<enrichment-source>
<cmdbs>
  
   <mqCode>
      active = true
      connection_url = jdbc:sqlserver://172.21.2.121:1433;DatabaseName=CA_UIM
      user = uimadmin
      password = IwkkWLy97XykOxygVqH8IA==_encrypted
      query = select ibmMqCodingScheme,channelStatus from Shob_MqChannelCodes where ibmMqCodingScheme =       CAST(? AS DECIMAL(10, 0))
      population_query = select ibmMqCodingScheme,channelStatus from Shob_MqChannelCodes
   </mqCode>
</cmdbs>
</enrichment-source>
<enrichment-rules>
exclusive_enrichment = no

<2>
   match_alarm_field = prid  
   match_alarm_regexp = (websphere_mq)
   use_enricher = mqCode
   lookup_by_alarm_field = udata.values.value
   lookup_by_regexp =
   <overwrite-rules>
      udata.custom_2 = AMIT
      udata.custom_1 = Enrich MQ: [cmdb.channelStatus]
   </overwrite-rules>
</2>
</enrichment-rules>

<routing-rules>
exclusive_routing = no
<1>
active = yes
post_subject = alarm2
condition = true
</1>
<2>
active = yes
post_subject = /setup/storm_subject
condition = true
</2>
</routing-rules>
<flood-protection>
routing_rules_during_flood = 2
routing_rules_no_flood = 1
</flood-protection>

this basically takes the value from the original alarm, checks it against the sql with the list of codes and then writes it to custom_1.

The last thing it tried it changing the message of the alarm so i did this: 

<overwrite-rules>
      udata.message = [udata.message] - [cmdb.channelStatus]
      udata.custom_1 = Enrich MQ: [cmdb.channelStatus]
   </overwrite-rules>

but this doesn't work. it appears that in the overwrite-rules you are only able to get data from cmdb.x and cannot get any access to udata... - (am i correct ??)

any way, the message said: [udata.message] - retrying

any suggestions? 

Thanks,

Amit,