Would like your help on how to enrich alarm coming from websphere_mq probe.
The alarm is on an mq channel, and it is showing the status code of the channel.
I would like to replace that code with a text or add the text to one of the custom fields.
The alarm look like this:
QOS_CHANNEL_CHANNEL_STATUS = 5.0 from source tsttux2.test.tase.co.il targeting MQ.TEST.REZEF.BOFFICE/TO.BOFFICE.2270 has crossed the critical static threshold of !=3.0
and would like to replace the 5.0 value with a text (for example: "retrying")
I am trying to do this with the alarm_enrichment.
i tried doing it with a script, and it worked ,but it causing me some problems with the soi intgration because the alarm is created with the code and then being changed and this is not so good... so i thought using the alarm enrichment but it is not going so well...
attaching a screen shot from dr. nimbus with the detailed of the alarm.
any help will be greatly appreciated !!.
Hello Amit, so just for my understanding you say the Alarm is pubished into SOI before it gets enriched in UIM ? Can you please attach a screenshot of the Alert in SOI itself ?
When i used the lua script to update the alarm, then the alarm is created in UIM and the connector sends it to SOI.
meanwhile, the script runs in UIM and update the alarms which causes the alarm to update is SOI.
Up to here everything is good.... BUT, when the alarm first arrived to SOI, it also triggered the escalation action which sends it by mail or sms, so it got sent before it was updated....
it all happens very quickly, so a screenshot is hard to make...
I solved half the problem....
First, I created a table in the DB that contain the codes and the text...
then i added this into the alarm enrichment in the nas.cfg:
<enrichment-source> <cmdbs> <mqCode> active = true connection_url = jdbc:sqlserver://172.21.2.121:1433;DatabaseName=CA_UIM user = uimadmin password = IwkkWLy97XykOxygVqH8IA==_encrypted query = select ibmMqCodingScheme,channelStatus from Shob_MqChannelCodes where ibmMqCodingScheme = CAST(? AS DECIMAL(10, 0)) population_query = select ibmMqCodingScheme,channelStatus from Shob_MqChannelCodes </mqCode> </cmdbs></enrichment-source><enrichment-rules> exclusive_enrichment = no
<2> match_alarm_field = prid match_alarm_regexp = (websphere_mq) use_enricher = mqCode lookup_by_alarm_field = udata.values.value lookup_by_regexp = <overwrite-rules> udata.custom_2 = AMIT udata.custom_1 = Enrich MQ: [cmdb.channelStatus] </overwrite-rules> </2></enrichment-rules>
<routing-rules> exclusive_routing = no <1> active = yes post_subject = alarm2 condition = true </1> <2> active = yes post_subject = /setup/storm_subject condition = true </2></routing-rules><flood-protection> routing_rules_during_flood = 2 routing_rules_no_flood = 1</flood-protection>
this basically takes the value from the original alarm, checks it against the sql with the list of codes and then writes it to custom_1.
The last thing it tried it changing the message of the alarm so i did this:
<overwrite-rules> udata.message = [udata.message] - [cmdb.channelStatus] udata.custom_1 = Enrich MQ: [cmdb.channelStatus] </overwrite-rules>
but this doesn't work. it appears that in the overwrite-rules you are only able to get data from cmdb.x and cannot get any access to udata... - (am i correct ??)
any way, the message said: [udata.message] - retrying