Deduplicating PATROL Events with Different mc_origin_key Slot Values

Description

Duplicate PATROL events can appear in BMC ProactiveNet Performance Management (BPPM) or in BMC Event Manager (BEM) if you used PATROL-Cell direct integration, BMC Impact Integration for PATROL v.3 (MCXP) or BMC Impact Integration for PATROL v.7 (Bii4p). This issue, which is not specific to the Sentry Software’s KMs, occurs when the event internal identifier, mc_origin_key slot, have different values for a same PATROL event. It can be solved by applying a rule.

Procedure

To deduplicate PATROL events in BPPM or BEM:

1. Create a file containing the following rule:

new NON_MATCHING_originKey_duplicates :
PATROL_EV ($EV) where [ $EV.status != CLOSED AND $EV.status != BLACKOUT ]
updates PATROL_EV($dup) where [ $dup.status != CLOSED AND $dup.status != BLACKOUT
AND $dup.mc_host_address == $EV.mc_host_address
AND $dup.p_origin == $EV.p_origin
AND $dup.pn_device_name == $EV.pn_device_name]
{
$dup.p_diary = $EV.p_diary;
$dup.p_status = $EV.p_status;
$dup.repeat_count = $dup.repeat_count + 1;
drop_new;
}
END

2. Save this file as sentry.mrl in the cell’s knowledge base rule directory MCELL_HOME/etc/<cellname>/kb/rules
3. Update your .load file accordingly:
   • Edit the .load file stored in MCELL_HOME/etc/<cellname>/kb/rule
   • Add an entry for the sentry rule. Please note that the entry must not include the “.mrl” extension
   • Save the .load file
4. Run the following command to compile the knowledge base:

   mccomp -n <cellname>

5. Run the following command to restart the cell:

   mcontrol -n <cellname> reload kb

Your events should now be deduplicated even if their mc_origin_key values differ.

Related Topics

• Closing Sentry Class-41 Events in BEM/BPPM when Class-9 Events are Generated
• Class-41 Events not Sent to Cell After Upgrading PATROL Agent to v9.5
• How to Generate Test PATROL_EV Events Using Monitoring Studio X
• Error Message is Unclear for Block Authentication Failures When Using the EMC Celerra Connector
• Enriching PATROL Events with More Meaningful Information