Deduplicating PATROL Events with Different mc_origin_key Slot Values

Description

Duplicate PATROL events can appear in BMC ProactiveNet Performance Management (BPPM) or in BMC Event Manager (BEM) if you used PATROL-Cell direct integration, BMC Impact Integration for PATROL v.3 (MCXP) or BMC Impact Integration for PATROL v.7 (Bii4p). This issue, which is not specific to the Sentry Software’s KMs, occurs when the event internal identifier, mc_origin_key slot, have different values for a same PATROL event. It can be solved by applying a rule.

Procedure

To deduplicate PATROL events in BPPM or BEM:

1. Create a file containing the following rule:

new NON_MATCHING_originKey_duplicates :
PATROL_EV ($EV) where [ $EV.status != CLOSED AND $EV.status != BLACKOUT ]
updates PATROL_EV($dup) where [ $dup.status != CLOSED AND $dup.status != BLACKOUT
AND $dup.mc_host_address == $EV.mc_host_address
AND $dup.p_origin == $EV.p_origin
AND $dup.pn_device_name == $EV.pn_device_name]
{
$dup.p_diary = $EV.p_diary;
$dup.p_status = $EV.p_status;
$dup.repeat_count = $dup.repeat_count + 1;
drop_new;
}
END

2. Save this file as sentry.mrl in the cell’s knowledge base rule directory MCELL_HOME/etc/<cellname>/kb/rules
3. Update your .load file accordingly:
   • Edit the .load file stored in MCELL_HOME/etc/<cellname>/kb/rule
   • Add an entry for the sentry rule. Please note that the entry must not include the “.mrl” extension
   • Save the .load file
4. Run the following command to compile the knowledge base:

   mccomp -n <cellname>

5. Run the following command to restart the cell:

   mcontrol -n <cellname> reload kb

Your events should now be deduplicated even if their mc_origin_key values differ.

Related Topics

• Empty Values for mc_object_class, mc_object and mc_parameter Slots in the Sentry KMs ' Events
• Class-41 Events not Sent to Cell After Upgrading PATROL Agent to v9.5
• Updating the mc_host and mc_host_address Slots of Sentry Class-41 Events in BEM with the Actual Hostname and IP Address of the Remotely Monitored System
• Unable to Monitor Hardware Using SNMP-based Connectors with PATROL Agent v.9.5.00.02
• Hitachi Device Manager Running out of Memory