Downloads
Introduction
Each time a threshold is breached:
- Events of class ALARM are generated by BMC Helix Operations Management (BHOM). These events are based on signature/static thresholds
- Events of
class 11or9are generated by the PATROL Agent STD_41or specific PATROL events such asHardwareProblem,ConnectorProblem,StorageProblem,Studio, etc. are generated by the Sentry Software’s KMs. These events are based on custom thresholds recommended and exposed by manufacturers.
By default, the PATROL Agent does not send PATROL_EV events to BMC Helix Operations Managements. However, since the events generated by the Sentry Software’s KMs provide more information about the actual problem, we strongly recommend to expose them in your BMC Helix Operations Management Events console. Here is an example of the event enriched with the message of the event generated by Sentry Software’s KM:
In this article, you will learn how to:
- force the PATROL Agent to send PATROL events to BMC Helix Operations Management Events
- enrich the events of
class 11with the message generated by Sentry’s KMs and delete Sentry Events to reduce the number of events. - allow OK events (
p_class == 9) to close previous alarms/warnings.
Procedure
Forcing the PATROL Agent to send PATROL Events
To allow PATROL events of class PATROL_EV to be sent to Helix, add the following ruleset to your PATROL Agent through a monitoring policy or by using other tools such as pconfig, wpconfig, or PATROL Configuration Manager:
"/AgentSetup/integration/HelixMonitorEvents" = { REPLACE = "1" }
Enrich the events of class 11 and delete the Sentry ones
To update and enrich the events of class 11 with the message generated by Sentry’s KMs, you need to create the following event policy in BMC Helix Operations Management:
class equals 'PATROL_EV' AND ( p_class has_suffix 'Problem' OR p_class equals 'Studio' )
as explained below:
-
Connect to BMC Helix Operations Management
-
Go to Configuration > Event Policies and configure the policy below:
-
In the Policy Configuration pull-down list, click Advanced Enrichment and create this rule:
-
Save your changes.
This policy can be imported using the ManagingSentryPATROLEvents-Final.json file (available in the Downloads section)
Related Topics
- How to Migrate Monitoring Studio X Policies from TrueSight to Helix Operations Management
- More Easily Identify Your Devices Monitored Through a Proxy in TrueSight / Helix Operations Management
- How to Manually Set Agent Thresholds in a CMA Policy
- Enriching PATROL Events with More Meaningful Information
- Using Macros to Customize PATROL Event Alert Actions