LUA Script for User Tag or other fields

[Mike Bowling]

Scripting is not my forte...hence this post.  TIA for any help\direction.

We need to append a message to the 'Robot Inactive' alert to designate a certain team to receive a ticket for the down system.  The message will have this designation based on the info in the User Tag 2 field.  Creating the Pre-Processing rule is no problem, just the correct programing so we only have one script to handle appending the message instead of multiple.

We have the basic append verbiage:

     event.message = event.message .. " - BCA - Create ticket for xxx Field Services"
     return event

What I need is the logic to view the User Tag 2 field for info and insert the correct location acronym into the message.

For instance, if User Tag 2 contains AHC, the above message appendage would be " - BCA - Create ticket for AHC Field Services"

We do not need to change severity or anything else about the alert, just simply append a specific message based on information in a specific field.

Thanks!

[Garin Walsh]

This still has the test code in it but how about something like this:

event = {}

event.user_tag_2 = "XYZ"

event.message = "this is the message"

 

list = { ["AHC"] = " - BCA - Create ticket for AHC Field Services", 

         ["XYZ"] = " - BCA - Create ticket for XYZ Field Services", }

 

for k, v in pairs(list)

do

   if ( event.user_tag_2:find(k) ) then

      print( "found " .. k )

      event.message = event.message .. " - BCA - Create ticket for xxx Field Services"

   end

end

 

print(event.message)

You didn't say if your match text might have many values but I assumed it might

[Garin Walsh]

Looks like my answer went to moderation - might be a couple days for you to see it - sorry

[Garin Walsh]

Try 2

event = {}

event.user_tag_2 = "XYZ"

event.message = "this is the message"

 

list = { ["AHC"] = " - BCA - Create ticket for AHC Field Services", 

         ["XYZ"] = " - BCA - Create ticket for XYZ Field Services", }

 

for k, v in pairs(list)

do

   if ( event.user_tag_2:find(k) ) then

      print( "found " .. k )

      event.message = event.message .. v

   end

end

 

print(event.message)

[Rowan Collis]

Can you try the following :

event.message = event.message .. " - BCA - Create ticket for "..event.user_tag2.." Field Services"
return event

This is only going to work in a Pre-process custom script

[Mike Bowling]

This one works so far...thanks Rowan...

event.message = event.message .. " - BCA - Create ticket for "..event.user_tag2.." Field Services"
return event

The only thing I did find with this is that if there is no entry in the User Tag 2 field, the alert does not post to the IM Console but somehow does get picked up by the SNMP Gateway and shows up on our Spectrum console...and without the added verbiage??  As long as there is an entry in the #2 field I think this will work.

[Mike Bowling]

Garin...forgive my ignorance but are you saying that what you provided was 2 different scripts or one and try it as the 2nd one provided to my question?

To answer you question, the User Tag 2 field will have one of three different entries:  AHC, AHN, or AHF  

Will need one of those to be in the alert....

Thanks!

[Olaf Pape]

Hi Mike,

if User Tag 2 is empty the event.user_tag2 returns nil. The script runs into an error like "attempt to concatenate a nil value..." and this alarm message is gone (not processed by the nas).

To prevent this just use an if construct, like this:

if event.user_tag2 == nil then 
    event.message = event.message .. " - BCA - Create ticket (without Field Service assignment)"
else
     event.message = event.message .. " - BCA - Create ticket for "..event.user_tag2.." Field Services"
end
return event

Hope this helps.

[Mike Bowling]

Olaf...this works well.  Thanks for the clarification!

We are currently transitioning from the legacy SNMP Gateway to the Spectrum Gateway and we have found that the SNMP Gtw appears to pick up the alert BEFORE it is processed by the NAS so those alerts on Spectrum do not have the appended message at all.  The Spectrum Gtw does obviously but was leaving it out because of the empty value.  This explained that behavior.

[Garin Walsh]

You will find that there's many ways to arrive at the ultimate final answer.

Don't worry about your initial post being too long or wordy, the more the better, especially when forum moderation might delay someone's reply hours or days. And often times something in the additional details either invalidates (or validates) possible responses.

Because you are picking into preprocessing scripts and there's not a lot of information about them, here's a couple things to keep in mind:

Nas will only run one preprocessing script - it will step through all the defined filters until the first match and then run that. There's been some back and forth about whether it's alphabetic or definition order in the cfg file that drives the evaluation order but ultimately I came to the conclusion that it was best for me to have only two preprocessing scripts: one that matched my production systems and one that matched my test/preproduction ones. I then was able to put all my matching logic in the script.

With everything in one file, any changes to that file become a big deal for testing. So, when I look at a request like your original one for my environment I ask the question of what will happen when I complete this work and another "entity" comes along? You typically have two options: Olaf's solution combines the data (entity name) with the logic which is an excellent process if the criteria is never going to change, the alternate solution in my suggestion is to separate the logic from the data so that the testing you do initially is valid whether there's 2 or 50 entities and when you need to add that 51st entity you really just need to test if the data change worked, not if any of the additional code broke any of the existing. 

So, to update what I initially wrote to reflect your three entities, the guts of it would look like:

-- Build the event structure for testing

event = {}

event.user_tag_2 = "AHC"

event.message = "this is the message"

 

-- list is a table where the index is the value matched against your user tag 2 value and the value is whatever the append string is

list ={ ["AHC"] = " - BCA - Create ticket for AHC Field Services",

        ["AHN"] = " - BCA - Create ticket for AHN Field Services",

        ["AHF"] = " - BCA - Create ticket for AHF Field Services",} -- Note that the trailing , is perfectly valid - Lua allows that because sometimes lists like this are script generated and you don't have to handle the final line as a special case in generating it.

 

-- Always test values before you use them - saves headaches in the future

if ( event.user_tag_2 ~= nil ) then

   -- Iterate over the table - k will hold the key value (AHC, AHN, AHF, etc.) and v will be the replacement string

   for k, v in pairs(list)

   do

      if ( event.user_tag_2:find(k) ) then

         print( "found " .. k )

         event.message = event.message .. v

         break

      end

   end

else

   -- User tag 2 had no value

end

 

-- Display the result - probably "return event" in an actual script

print(event.message)