DX Operational Intelligence

Expand all | Collapse all

Can we auto assign alert to SOI user who ACK'd the alert?

Daniel Blanco09-10-2014 09:51 AM

  • 1.  Can we auto assign alert to SOI user who ACK'd the alert?

    Posted 09-08-2014 04:27 PM

    Currently using the Spectrum and Nimsoft connectors.

    Our NOC is looking to know if is it possible to enhance the SOI functionality to auto assign the alert to the SOI user who ACK'd the alert?



  • 2.  Re: Can we auto assign alert to SOI user who ACK'd the alert?

    Posted 09-10-2014 09:51 AM

    BUMP, anyone know if this is possible?



  • 3.  Re: Can we auto assign alert to SOI user who ACK'd the alert?

    Broadcom Employee
    Posted 09-10-2014 10:19 AM

    Hi,

     

    you could do the following:

     

    1) Define a AlertQueue for alerts with acknowledge

    2) Assign an Escalation policy to this alert queue that trigger a action inmediately

    3) The action must run an script that:

         3.1) Looks in SAMStore and gets the name of the user who did the acknowledge action

         3.2) Update the Assigned attribute of the alert via REST Web Service

     

    Please, let me know if you need how to perform.

    Regards



  • 4.  Re: Can we auto assign alert to SOI user who ACK'd the alert?

    Posted 09-10-2014 04:26 PM

    Yes please can you explain how you would do this? Is there a way to do this without adding another alert queue? We have minimal alert queues to keep things clean and specific.

    I would need help with the script part and the update portion of the alert via REST Web service calls..



  • 5.  Re: Can we auto assign alert to SOI user who ACK'd the alert?

    Broadcom Employee
    Posted 09-11-2014 06:16 PM

    The only way I know to trigger an action when alert status changes is using alert queues. You could create a queue but not present to normal users.


    I will back to you with Rest example


    Regards



  • 6.  Re: Can we auto assign alert to SOI user who ACK'd the alert?

    Posted 09-16-2014 11:43 AM

    Hi Espjo04, any reply back yet regarding this? I don't fully understand the rest portion. Is it basically mimicking the UC functionality but making calls to the WebService that does that same thing? To utilize the REST do you have to program java or powershell then have the 3rd party application call that program when events occur?



  • 7.  Re: Can we auto assign alert to SOI user who ACK'd the alert?

    Posted 12-02-2014 04:03 AM

    Hi,

     

    dunno if you already solve this. With SOI 3.3. you are able to create an action which acknowledges the alert and updates the assigned attribute with the user id . In that case you dont need any scripts.

     

    regards

     

    Andre



  • 8.  Re: Can we auto assign alert to SOI user who ACK'd the alert?

    Posted 01-27-2015 10:55 PM

    Hi Andre, I actually tried this out on SOIv3.3 with the Policy that says when Acknowledge = YES, then Action: Update_Alert and I tried the AssignedTo = $[SOI_USER]@$[SOI_HOST] but that does not work. All alerts that have their ACK property set to YES then get the value:  NotSet@NotSet

     

    Did you have any luck with this Action: Alert_Update?



  • 9.  Re: Can we auto assign alert to SOI user who ACK'd the alert?

    Broadcom Employee
    Posted 01-28-2015 04:26 PM

    Have you tried to use $[Login User] and $[Login Host] as RuntimeTokens?

     

    Regards



  • 10.  Re: Can we auto assign alert to SOI user who ACK'd the alert?

    Posted 01-28-2015 09:34 PM

    Actually those are the variables I tried. But it doesn't work. Also there is no way as far as I can tell to specify If Ack changes from No to YES then do this action. Which is better applicable since if the alerts already contain ACK = YES, this will change the existing person assigned to it with NOT_SET@NOT_SET. 

    SOI_Action_AutoAssign.jpg



  • 11.  Re: Can we auto assign alert to SOI user who ACK'd the alert?

    Posted 07-24-2015 03:21 AM

    Could you please provide additional details on how to Update the Assigned attribute of the alert via REST Web Service.

     

    The user who has acknowledged the alert could be fetched from the table AuditRecords.



  • 12.  Re: Can we auto assign alert to SOI user who ACK'd the alert?

    Posted 07-24-2015 03:38 AM

    Rather than using escalation policies and external scripts, you can do the following:

    • Define an Escalation Action to "Acknowledge and Assign" an Alert
      • This consists of the action "Update Alert" with
        • Acknowledged = Yes
        • Assigned = $[Login User]
    • Then ask your people to use this Action on the console rather than the normal Acknowledge

     

    The $[Login User] is only set when interactively working on the console, e.g. it only works for manually executing an Action.

    If you use this variable in an Escalation Policy you get "not Set", because an Escalation Policy is triggered by the SA Manager and not by a user.

     

    MichaelBoehm



  • 13.  Re: Can we auto assign alert to SOI user who ACK'd the alert?

    Posted 07-24-2015 03:57 AM

    Thanks a lot for the alternative. The suggestion is good but we already have multiple actions defined in our environment due to which it might become tedious for the team to select the 'Acknowledge' action in comparison to selecting the "Acknowledge/Unacknowledged" icons.

     

    - Is there a way to create this action and somehow attach it with the "Acknowledge" icon in the SOI Alerts console i.e whenever the user click on the acknowledge icon, this new action is being executed. OR

    - Get a new icon added to the SOI Alerts console and link this new Action 'Acknowledge' with this new icon.

     

    Also by acknowledging an alert using an action doesn't get recorded in the 'Recent Audit Trail' nor in the 'Update History'. Is there any alternative to track these activities.



  • 14.  Re: Can we auto assign alert to SOI user who ACK'd the alert?

    Posted 07-24-2015 01:43 PM

    Thanks Michael, thanks for the reply but like Sachin mentioned as well, in the NOC, Ack'ing the alert thru the r-click, take action, then selecting that specific Action in the list of other actions of a list of 30+ actions is too tedious. Would really want a way link this action when someone does the Acknowledge action from the SOI Console.

     

    "If you use this variable in an Escalation Policy you get "not Set", because an Escalation Policy is triggered by the SA Manager and not by a user."


    Would like there to be an option in the SOI Escalation Actions to have this option so we can accomplish this the way we need it to work. In a NOC environment, the person who Ack's the alert is usually the person who is responsible/assigned until he/she then opens a Ticket and the ticket is then sync'd with the alert and the Assigned is then set to who's assigned to the ticket in the ticketing system.