Hi all,
I have issues with one alarm enrichment rule:
In the logs I can see this lines:
velj 22 14:33:37:784 [pool-2-thread-14, alarm_enrichment] AlarmEnrichmentService: Forwarding alarm to alarmEnricher 11
velj 22 14:33:37:784 [pool-2-thread-14, alarm_enrichment] CmdbMessageEnricher: processAlarm: input:INCSD NKSInst PROD CORE - Greska u aplikaciji IP WAS matching against:(NKSInst PROD)
velj 22 14:33:37:784 [pool-2-thread-14, alarm_enrichment] AlarmEnrichmentService: Forwarding alarm to alarmEnricher 12
velj 22 14:33:37:784 [pool-2-thread-14, alarm_enrichment] CmdbMessageEnricher: processAlarm: input:logmon matching against:(logmon)
velj 22 14:33:37:784 [pool-2-thread-14, alarm_enrichment] CmdbMessageEnricher: processAlarm matched on field: prid
Rule config is:
<11>
use_enricher = nksinst_enricher
match_alarm_regexp = (NKSInst PROD)
lookup_by_regexp =
match_alarm_field = udata.message
lookup_by_alarm_field = udata.source
<overwrite-rules>
udata.custom_3 = [cmdb.created_via]
udata.custom_2 = [cmdb.category]
udata.custom_1 = [cmdb.affected_resource]
</overwrite-rules>
</11>
From some reason, alarm message is not matched with the rule 11.
Does anybody know why?