DX Unified Infrastructure Management

Hello,

I am receiving an alarm using the email2alarm probe and need to clean up the alarm message before it actually gets processed. I am trying to accomplish this via LUA script and preprocessing rule.

I only want in the portion staring from Details to "windowsize" to be part of the alarm message and drop the rest. Has somebody done something similar and if so can you share the syntax to do this? Thanks!

==

message:Hello,

You are assigned 1 triggered incident:

1) Incident #1
   Opened on: Oct 19 at 9:06 AM CDT
   Description: test01: Percentage CPU GreaterThan 1 undefined
   Details:
       resourceName: test01
       resourceId: /subscriptions/0000000/resourceGroups/US_IT/providers/Microsoft.Compute/virtualMachines/host
       resourceRegion: westus
       condition: {"metricName"=>"Percentage CPU", "metricValue"=>"18.3483333333333", "threshold"=>"1", "windowSize"=>"5", "timeAggregation"=>"Average", "operator"=>"GreaterThan"}
       resourceType: microsoft.compute/virtualmachines
       name: CPU Usage Percent

so this will require the use of regex.

some articles on basic regex below:

Gene, thanks for the reply. In regexbuddy what language do you select for building UIM based expressions?

Not sure if regex does the tick here. I am trying to create a new alarm message with only the following portion of the message:

Details:
       resourceName: test01
       resourceId: /subscriptions/0000000/resourceGroups/US_IT/providers/Microsoft.Compute/virtualMachines/host
       resourceRegion: westus
       condition: {"metricName"=>"Percentage CPU", "metricValue"=>"18.3483333333333", "threshold"=>"1", "windowSize"=>"5", "timeAggregation"=>"Average", "operator"=>"GreaterThan"}
       resourceType: microsoft.compute/virtualmachines
       name: CPU Usage Percent

This means I guess I need to do some match to tell LUA to only pick the section of the message that starts with details and ends at name.

Thoughts?

perl is the language you choose in regex buddy.

I guess you could use string matching as well but i think you are better off with regex as the messages will probably be dynamic in some way.

Thanks Gene for the pointers. Very helpful as usual.

Johannes

Dutchie/Gene, I hope to learn about this. May I ask what is the resolution? I am also trying to do the same. I wanted to replace the “host_name” in below message. Kindly teach me how to do this in LUA scripting that is running in the Pre-Processing Rule. Thanks.

IM_SA_UNIX host_name ECC_Errors There is issue in ECC on this server.

Sharing the solution I got on this.

event.message = string.gsub(event.message,"host_name",event.robot)

return (event)