Configuration Item mapping issue, during the creation of alert from event

[Rucha3]

Hello,

I have created an event rule to process the event and create an alert. But I am facing below issue sometimes. It would be great if I get some help.

Configuration item field which is present in an alert table was getting populated properly sometimes but in few of the alert, I am getting below error and whenever I got an error the Configuration item field is empty.

Processing notes of Event:

Binding alert CI process flow:

Run Identification Engine. No matching CI was found.

Identification Engine Errors:

                Too many other errors.

                In payload missing minimum set of input values for criterion (matching) attributes from identify rule for table [cmdb_ci_hardware]. Add these input values in payload item '{"className":"cmdb_ci_server","values":{"discovery_source":"Manual Entry","u_code":null}}'.

Node is FQDN

Node was not found, checking by name

Event CI type is empty

No CI found for binding (Failed to resolve the event node to CI id)

In the event, the node field contains Configuration Item and I am fetching that in 'CI Code' using standard format in transform and compose output and in binding section, I am overriding the default binding and put the binding as mention in below snapshot.

I didn't understand why "u_code"  is getting null and even I check the CI, that CI is present in configuration item class.

Regards,

Rucha

[ori2]

Hi,

In the Criterion attribute write u_code

and under the transform tab of the Event rule, add field with the name u_code and populate it with the information from the alert field or from the additional info field which has the identify data for this CI.

if it doesn't work mention what data you have on the additional info or on what field it's used, so I'll be able to see what is missed.

Regards,

Ori

[Rucha3]

Hi Ori,

Thanks for quick reply.

In criterion attribute it is 'u_code' only.

and Code(u_code) is the field from the cmdb_ci class which is holding the configuration item name. Hope you understand this. For better understanding look at below snapshot.

so why there is need to for the 2nd point you mention.

Regards,

Rucha

[ori2]

Hi Rucha,

I understand that this is the identifier of the CI, what I meant, is that the binding expects this data to be populated on the Event (usually from the additional info) I believe that this data is somehow written on the event? otherwise how would the binding mechanism would understand how to bind the alert to the CI,do you think you can use CI field matching instead?

If it's suits your case it will work better because it uses only the fields to do the binding. (CI identifier uses an Identification engine that can use relations and it might require more data regards the configured system identifiers)

I'll give you an example to make it more clear:

let's say that you have a record on cmdb_ci that looks like this:

code: 123 , name: example , manufacturer: servicenow, model name: testing, model/version: 1

(assuming that the CI identifier for this specific CI is only the Code)

Now let's say we have an Event with the following data on the additional info:

{"name":"test", "problem":"high cpu", "u_code":"123"}

On this case, the event rule will bind the Alert to the CI because, because the data for identifying the CI is on the additional Info.

If this data is written but not as the field name, for example:

{"name":"test", "problem":"high cpu", "machine_code":"123"}

Then you will need to add a transformation on the Transform tab of the Event rule, that will be:

u_code:machine_code

And then the binding will work as expected.

On your example, you can add to the Transform tab the data hard coded, for example, if you have some events that this event rules applies for them and you want them to be binded to a specific CI (per rule) you can add a field of u_code on the transform so it will be: "u_code: CI Code" and it will bind it to the CI which its field has "CI Code" within its CI record data.

I hope that the example will make this subject more clear,

Regards,

Ori

[Balaji14]

Hi Rucha,

Can you please try the same with CI Field matching binding type?

Since you have chosen the binding type as CI identification it is running the CI identifiers for the Class Server. And the error is mostly due to not pulling all the required information such as the criterion attribute to satisfy the CI identifiers for the Class Server.

You can either check which Identifier rule which is getting triggered and pull in all the required criterion attribute to satisfy it, or change it to CI field matching and follow the mentioned steps to bind it to a CI.

Regards

Balaji