Is it possible to make a default severity mapping in a severity map file?

[lilah]

Hi everyone,

 

Suppose I wanted to check the value of an event variable and decide which severity to assign according to the value. For example:

 

If "blue" or "green" set as Critical

If "yellow" set as Minor

Default set as Major

 

I haven't found any documentation on how to set the default. Is this possible, or do conditional event severities require configuring each possible value for the varbind to work as expected?

 

If this feature doesn't exist, does anyone know how to implement something similar via EventDisp?

[Olaf Schalenberg]

not sure if it is possible via severity mapping. Here is a quick example with events

0xfff0001 E 20 R Aprisma.EventCondition, \

      "regexp( {v 5}, {S \"yellow\"} )", "0xfff0002 -:-",\

      "regexp( {v 5}, {S \"blue\"} )", "0xfff0003 -:-",\

      "regexp( {v 5}, {S \"green\"} )", "0xfff0003 -:-",\

      "default", "0xfff0004 -:-"

0xfff0002 E 20 A 1,0xfff0001

0xfff0003 E 20 A 3,0xfff0001

0xfff0004 E 20 A 2,0xfff0001

[lilah]

Hi Olaf,

 

Thanks for the code.

 

Creating a separate event for each possibility is my existing but least preferred option, I was hoping for something more scalable.

[ackjo04]

My research does not show a way to set a default value.

[Justin_Kulikowski]

I think you need a combination of two approaches to get all that you're looking for:

 

1.) Conditional Alarm Severity:  Working with Events and Alarms - CA Spectrum - 10.1 and 10.1.1 - CA Technologies Documentation

 

This should let you define a mapping for blue => critical, green => critical, yellow => minor, etc.

 

2.) Event Condition Rule

 

Conditional Alarm Severity doesn't allow you to set a Default though, so for this I think you'll still need a Event Condition similar to what OlafS provided.

 

 

 

Here's the workflow that may work for you:

 

1.) Distinguish between known & unknown severity levels

 

0xfff0001 R CA.EventCondition, \

        "(regexp({v 5}, {S \"blue|yellow|green\"}))" , "0xfff0002   -:-",\

        "default" , "0xfff0003   -:-"

 

2.)  0xfff0002 - Set the Conditional Alarm Severity here

 

3.)  0xfff0003 - Define the default severity here

 

This should scale for you, as any new conditions would only have two touch-points (extending the regex to catch the known severity levels, and then also defining the conditional severity mapping itself) and shouldn't result in any new event files being created.