Forwarding Alarms Via a Rule and Script

It appears Foglight for Integrations 5.9.4 (and earlier version) describes the interface as having tabs in "Forwarding Alarms to Third-Party Systems" but such tabs do not exist.  Further, it states a need to have a groovy script counter part but goes into no details on even what that means and doesn't provide an inventory of variables or any syntax to use in the application in order to pass along the data.

When I contacted support, they had no other documentation besides this.  As a work around they suggested I "copy" the Integration Cartridges' Alarm Integration rule and attempted to modify it.   This worked to a point.  Specifically, the copy enabled me to pass the event object but when it hit the script it simply passed the text "DataObject of type foglight-5:AlarmSystemEvent for datasource: foglight-5:foglight-5 :/anonymous/315e5e2b-6b89-4979-87b5-934c1c6a80fd"  So not terribly helpful

Script:

#############################################################################

# PROGRAM: sendTest.ps1             Daniel L. Needles          12/15/2020   #

# PURPOSE: Writes Alarm info locally.                                       #

# USAGE:   powershell "c:\temp\foglightNotificationTest.ps1" @event         #

# EXAMPLE: powershell C:\TEMP\sendTest.ps1 "This is a test and only a test" #

#############################################################################

write-output "Ran" | Out-File -FilePath "C:\TEMP\ran.txt"

$unixSecondsTag = (New-Timespan -Start (Get-Date 01/01/1970) -End (Get-Date)).TotalSeconds | Out-String

$outfile = 'C:\TEMP\Alarm-' + "$unixSecondsTag".replace("`n",'').replace("`r",'') + '.txt'

write-output "$args" | Out-File -FilePath "$outfile"

So I tried to access to object and pass that such as  @event.get("alarmID")   However, this simply caused everything to stop working without reporting any errors.  I also was unable to identify any logs to see what the product thought was going on in order to iterate to a solution.

Next, I tried to reference the other variables directly. Again, nothing happened and again there were no logs, errors, etc.  I suspect this is where the groovy script writing comes into play but besides the passing reference I have found nothing on that. 

Finally, after searching via Google and Quest FU, I found only scant indirect information on this topic.

Has anyone gotten Forwarding Alarms to work?  If so is there a handy RTFM note, PDF, etc anywhere?

Parents Reply
  • Unfortunately, I tried all those and more.  The issue is specifically how @event works to call a script.  I went through the Integration User and Reference guide, several blog posts (including the one above.) As well as watched several videos - https://www.quest.com/community/blogs/b/performance-monitoring/posts/foglight-skills-101---alarms  Another good but not helpful source for this was - https://support.quest.com/technical-documents/foglight-evolve/9.0/administration-and-configuration-guide/20#TOPIC-1242140 

    If you note in the videos like the documentation, when it comes to the "binding" of events, in each video he says, he doesn't have time or cannot go over it now, etc.

    The specific problem right now is I put @event.get("message") in the Rule Editor, it doesn't want to bind. It only works if I put @event in which case it sends the text shown above.  Also what is odd, is according the the guide it also needs defining via Condition & Actions => Fire => IntegrationAction.  In here the instructions say bind the @event (via alarm_event) to Alarm System Event.  Wouldn't this basically overwrite the context of Rule Variables tab's entry alarm_event/ Expression / @event.get("message").

    The instructions surrounding how this double binding and how to expose the components of @event are completely lacking in all the references I listed.  I can find a manifest of @event variables via a blog post and document, but how this binding works is completely absent. 

Children
  • Hi Daniel,

    I did some test yesteday and I found a bug with rule variables in Foglight version 5.9.5. Are you using that version? If yes, then you need to upgrade to version 5.9.7 which is the latest one.

    I just created a solution for it (solution number is: 330024), but it is not published yet. It will be available within the next hour.

    If that does not help, I would recommend contacting our PSO team or to raise a SR. It looks like a webex is needed to investigate how you configured the rule and the variables. You said you raised a SR already. May I ask for the SR number? I can review and contact my colleague who worked on it.

    Kind Regards

    Nicola

  • Hello ,

    We are assisting the customer via an active SR (#4817527) with help from R&D team.

    Regards

  • Thanks Nicola!!  SR 4817527.  I have a webEx this AM.  After reading (and being sent) every available manual, blog, and video I found no where in the documentation is a good explanation of how Foglight "binds" Foglight specific construct variables in the Rule Editor nor how to dereferences these addons to the Groovy language such as variables starting/ending with  '#' and '@' outside the Condition tab  There is some on '#' but next to nothing on the '@' variables such as @event.  There is an inventory of properties and it mentions in the Condition tab to use @event.get("message") for example. However, this will NOT work in the two tabs I mentioned.  Further, there is a wierd double binding thing going on in these two tabs where @event gets an "expression" and then that "expression" is bound to Alarm System thingy which seems to imply you only have @event avaialble for use and you cannot dereference a subcomponent of that or you'll get a type clash in the logs.  If someone could clarify what is going on here in documentation along with fixing the other documentation gaps I mentioned, I think that would go the furthest in helping the community.  Also make a video where the poor engineer doesn't run out of time before he gets to that part.  It was quite frustrating going through 3 video and finding everytime he skirted this very part.  Lol.  That said, having videos available was pretty cool.

  • We do this in a simple rule of type AlarmSystemEvent This goes in the alarm script
    (it's an extract of the actual code, untested :) )
    def topSvc = server.TopologyService;
    // alarmEvent information
    def eventType = @event.get("change/value");
    def alarmID = @event.get("alarmID");
    def topologyObjectID = @event.get("topologyObjectID");
    def sourceID = @event.get("sourceID");
    def sourceName = @event.get("sourceName");
    def isCleared = @event.get("isCleared");
    def isTransition = @event.get("isTransition");
    def nextSeverityLevel = @event.get("nextSeverityLevel");
    def severityLevel = @event.get("severityLevel");
    def message = @event.get("message");
    def isAcknowledged = @event.get("isAcknowledged");
    def clearedTime = @event.get("clearedTime");
    def ruleName= @event.get("ruleName");
    def ruleComments = @event.get("ruleComments");
    def ruleID = @event.get("ruleID");
    def alarmLink = @event.get("alarmLink");
    Then it's just standard groovy
    to = topSvc.getObject(topologyObjectID)
    def mMonitoredHost = null;
    mMonitoredHost = to.get("monitoredHost/name")
    With standard groovy you can execute any command at the OS level
    Im using this on linux so not sure how that works for powershell
  • I've got this as a reference for the @event variable:

    We may use the following properties (accessible through the “get” method) on the @event variable:

    created                

    Event creation timestamp

    alarmID               

    Unique alarm identifier

    sourceID 

    Unique identifier or alarm source

    sourceName

    Human readable name of alarm source

    isCleared

    Has the alarm been cleared?

    severityLevel      

    Severity (0=Normal, 1=Info, 2=Warning, 3=Critical, 4=Fatal)

    message            

    Alarm message

    isAcknowledged

    Has the alarm been acknowledged?

    clearedTime         

    Date and time when alarm was cleared

    ruleName           

    Name of rule that triggered the alarm

    ruleComments   

    Textual comments about the triggering rule

    ruleID

    Unique identifier of triggering rule

    alarmLink

    URL to display alarm in user interface

    You can use it in the rule condition to, in order to limit what rules fire the integration action, for example:

     

    !@event.get(“isCleared”) &&

    @event.get(“rulename”).startsWith(“DBO_”)

     

    The rule would fire only if the alarm is NOT cleared and the rule name starts with DBO (Oracle related alarms).

  • I worked with support and in the end the copy and edit of the integration cartridge didn't work.  Instead we used Create Rule and created CommandAction and configured it with:

    and then under the Rules Variable we added the two variables referenced:

    msg
    Expression
    @event.message
    alarmid
    Expression
    @event.alarmID

    Along with the other bit mentioned above the script executed and wrote the variables.  This still needs to be documented some where. 

    The available groovyized variables are:

    def eventType = @event.get("change/value");
    def alarmID = @event.get("alarmID");
    def topologyObjectID = @event.get("topologyObjectID");
    def sourceID = @event.get("sourceID");
    def sourceName = @event.get("sourceName");
    def isCleared = @event.get("isCleared");
    def isTransition = @event.get("isTransition");
    def nextSeverityLevel = @event.get("nextSeverityLevel");
    def severityLevel = @event.get("severityLevel");
    def message = @event.get("message");
    def isAcknowledged = @event.get("isAcknowledged");
    def clearedTime = @event.get("clearedTime");
    def ruleName= @event.get("ruleName");
    def ruleComments = @event.get("ruleComments");
    def ruleID = @event.get("ruleID");
    def alarmLink = @event.get("alarmLink");

    To get the events off the server and over to Netcool I used the Socket Probe for OMNIbus and the following Powershell script.  Using these as working shells I can build out what I need

    $FTPServer = 'IP_ADDR1' ## -- Netcool OLD Development OMNIbus
    #$FTPServer='IP_ADDR2' ## -- Netcool OLD Secondary Production OMNIbus
    $FTPPort = PORTNUMBER
    $tcpConnection = New-Object System.Net.Sockets.TcpClient($FTPServer, $FTPPort)
    $tcpStream = $tcpConnection.GetStream()
    $reader = New-Object System.IO.StreamReader($tcpStream)
    $writer = New-Object System.IO.StreamWriter($tcpStream)
    $writer.AutoFlush = $true

    $buffer = new-object System.Byte[] 1024
    $encoding = new-object System.Text.AsciiEncoding

    while ($tcpConnection.Connected)
    {
    while ($tcpStream.DataAvailable)
    {

    $rawresponse = $reader.Read($buffer, 0, 1024)
    $response = $encoding.GetString($buffer, 0, $rawresponse)
    }

    if ($tcpConnection.Connected)
    {
    Write-Host -NoNewline "prompt> "
    $command = Read-Host

    if ($command -eq "escape")
    {
    break
    }

    #$writer.WriteLine($command) | Out-Null
    $writer.WriteLine($command) | Write-Host
    }
    start-sleep -Milliseconds 500
    }

    $reader.Close()
    $writer.Close()
    $tcpConnection.Close()