Closing Sentry Class-41 Events in BEM/BPPM when Class-9 Events are Generated

  • kb1141
  • May. 30, 2014
  • 2 min read

How to change the default cell rule to close the Sentry class-41 events when class-9 events are generated.

Best Practice BEM BPPM cell Class 9 Class 11 Class 41 Events MCELL PATROL Agent

Related Topics

Description

Class-41 events are generated by the Sentry KMs, such as Hardware Sentry KM for PATROL and Monitoring Studio KM for PATROL, each time a threshold is exceeded. Contrary to the class-11 events that are generated by the PATROL Agent and that contain the bare minimum of the fault, the class-41 events contain the full health report by detailing the fault that has occurred.

When the alarm no longer exists, a class-9 event (STATE_CHANGE) is generated by the PATROL Agent and closes the class-11 event but the class-41 event remains open with the same severity. To automatically close the class-41 event when the class-9 event is generated, you need to modify the default cell rule.

Solution

Depending on your PATROL architecture, you will have to either modify the:

  • mcxp.mrl file (PATROL v.3)
  • or the bii4p.mrl file (PATROL v.7)

to make the default cell rule close the Sentry class-41 events.

Modifying the mcxp.mrl (PATROL V.3)

  1. Open the mcxp.mrl file located in MCELL_HOME/etc/<cellname>/kb/rules/
  2. Find the following line: 
    3. $OLD.p_class  within [9,11,16,39, UpdParState]
  3. Add “41” to the line to have: 
$OLD.p_class  within [9,11,16,39,41, UpdParState]

Here is the result as it will appear in the code:


#############################
## Indexed adapt_param_status
#############################

new adapt_param_status :
PATROL_EV($NEW)
where
[
#p_catalog: within [0,STD,STANDARD],
p_class: within [9,11,16,39,UpdParState]
]
using ALL
{
PATROL_IDX ($IDX)
where
[
$IDX.p_origin == $NEW.p_origin AND
$IDX.p_agent_port == $NEW.p_agent_port AND
$IDX.mc_host_address == $NEW.mc_host_address
]
PATROL_EV ($OLD)
where
[
$OLD.status != CLOSED AND
$OLD.mc_ueid == $IDX.PATROL_ueid AND
$OLD.p_class within [9,11,16,39, 41, UpdParState]
#AND $OLD.p_catalog within [0,STD,STANDARD]
]
}
triggers
{
$OLD.status = CLOSED ;
}
END

Modifying the bii4p.mrl file (PATROL V.7)

  1. Open the bii4p.mrl file located in MCELL_HOME/etc/<cellname>/kb/rules/
  2. Find the following line:
    3.   
    $OLD.p_class  within [9,10, 11,12,16,39,UpdParState] AND
  3. Add “41” to the line to have: 
    4.   
    $OLD.p_class  within [9,10, 11,12,16,39,41,UpdParState]  AND

    Here is the result as it will appear in the code:

      
    #######################
    
    ## Indexed adapt_param_status 
    
    ######################
    
  
    new adapt_param_status : 
    
    PATROL_EV($NEW) 
    
    where [ $NEW.status !=  CLOSED AND $NEW.status != BLACKOUT AND
    
    $NEW.p_class_group ==  "param_group" AND 
    
    $NEW.p_catalog == "STD" ]
    
    using ALL 
    
    { 
    
    PATROL_IDX ($IDX) 
    
    where [ $IDX.p_origin == $NEW.p_origin  AND 
    
    $IDX.p_agent_port == $NEW.p_agent_port AND
    
    $IDX.mc_host_address  ==$NEW.mc_host_address ]
    
    PATROL_EV ($OLD) 
    
    where [  $OLD.status != CLOSED AND $OLD.status != BLACKOUT AND
    
    $OLD.mc_ueid == $IDX.PATROL_ueid AND
    
    $OLD.p_class within [9,10, 11,12,16,39,41,UpdParState] AND 
    
    $OLD.p_catalog == "STD" ]
    
    }
    
    triggers
    
    {
    
    $OLD.status       = CLOSED ;
    
    }
    
    END
  4. Save the .mrl file.
  5. Run these commands on the machine where the cell is running: 
    6.   
    Mccomp -n  <cellname>
    
  Mcontrol -n <cellname> reload kb
  6. Generate new events of class 11, 41, and then 9.
  7. Check out the result in the Impact Explorer/BPPM Ops console.
Best Practice BEM BPPM cell Class 9 Class 11 Class 41 Events MCELL PATROL Agent