Event and Alerts: how to select an active CI

[Ernesto di San1]

Dear all,

I'd like to find a way to relate events and alerts to ONLY active CIs (active I mean CIs with "installed" status).

In my servers' list, I can have more than one machine with the same name, one in "installed" status and other(s) with inactive status (e.g. "retired", "junked", etc.)

Where can I filter or define records retrieved by event rules? any hint?

Thanks in advance

Cheers,

Ernesto

[Tony Branton]

The easiest option I can think of is to use an Alert Rule to close any alerts created for CI's where the installed_status field is not set to "Installed".   You can do this by configuring an Alert Rule to apply an Overwrite alert template for any alerts with a filter condition of Configuration item.Status | is not | Installed and creating an Alert Template that sets the Alert's State field to Closed.   Note that I'm using the related fields for the Configuration item reference field.

It would be nice to be able to exclude inactive CI's from event processing - I'll submit this as feedback to product management.

In the meantime, hope this workaround helps.

[Ernesto di San1]

Hi Tony,

first of all thank you for your kind feedback.

I also thought to a similar solution, problem here is that I need to leave the alert open (I cannot close it, because it is a real alert on the active CI), but alert should retrieve only the active one and not to the retired servers.

Anyway, I've just updated the "Hardware" CI Identifier, adding the state field in the Optional Condition to filter records, let's see if this solution works fine

I'll keep this post updated if any news.

Ernesto

P.S. I completely agree with you when you say tha inactive CIs should be excluded from event management.

[Tony Branton]

Hi Ernesto,

Hopefully tweaking the CI Identification Engine will work.   Note that if the alert-to-CI binding is currently occurring without an Event Rule then the binding is occurring using the default node-to-CI matching process (see Alert binding to CIs with event rules in the Product Documentation).   Adjusting the CI Identifier may not act as an exclusion filter - it may just match the CI more reliably.

The workaround provided above ensures that any alerts created for CIs that are not active are automatically closed.   Alerts will remain open if the CI Status field is "Installed" (I'd also include "In Maintenance").

You'd want to use this condition in other Alert Rules (e.g. for creating Incidents) to ensure alerts for inactive CIs do not trigger any actions.

Let me know how you go with the CI Identification method.