Event Rules: Binding to a CI uses an additional field not configured in Event Rule

[Jon Traynor]

Hi,

I have created several event rules to bind to CIs depending on the required filters. What I am seeing however is an extra field being used in the CI bind that is not configured in the event rule used, nor in any event binding scripts. The extra field is a custom field I have created but is not relevant to the binding to the CI Type. Using Check Processing of Event link I can see it hits the right rule, but what I would like to see ideally is a debug of what the event processing is actually doing and why it is picking up this non-relevant field to use for binding to a CI. 

I know the Event Rules work as I have exported all rules via an update set and imported into a fresh developer instance and tested. The rules work as expected and bind to the expected CI.

So my questions are, what else could be influencing the CI binding process to include this field in the evaluation and is there some way of debugging the event processing?

Thanks

Jon

[robertgeen]

I haven't found a really good way to debug the binding outside of what is put in the em_event entry. Do you have any CI binding overrides in your event rule? If not then it should be doing it on  name, ip_address, and mac address information found in the cmdb_ci_hardware CI table attributes (although the mac address must reference other tables but it all goes back to a hardware table). If you have it overriding the binding and node is blank then it will use whatever variables you have in the additional_info section and will match it to corresponding attribute names in the table you choose in the ci binding section. Hope this helps.

[Jon Traynor]

Hi Robert,

Thanks for the response. Yes, so for one of my event rules as an example I am overriding the default binding and binding to CI field matching CI Type Network Adapter. In Transform & Compose I have created a manual attribute called 'name' which I’ve mapped to one of the fields ($Resource) contained in Additional Information from the incoming event. On my developer instance the processing notes of the event look good as follows:

Custom script 'EvtMgmtCustom_PostBind_Create' called successfully for event

Binding alert CI process flow:

Node will be resolved to CI id: 53958ff0c0a801640171ec76aa0c8f86 : found by node name

Event CI type is cmdb_ci_network_adapter

Query with fields:

name : en100

The event CI type is device, trying to check for matching device

Found matching device (using type: cmdb_ci_network_adapter defined in em_binding_device_map table)

Bounding will be done with a matching device (id): 2ea2716fdb362300ae8ff6fdbf9619b2

Bind to 2ea2716fdb362300ae8ff6fdbf9619b2 

Event rule applied: JT Interface

However, on the customers Dev instance with an identical event rule, as well as the bind with the network adapter and manual attribute, it is also using one of the other fields contained in Additional Information, as follows in the processing notes:

Custom script 'EvtMgmtCustom_PostBind_Create' called successfully for event

Binding alert CI process flow:

Event CI type is cmdb_ci_network_adapter

Query with fields:

u_group : Test_Group

name : en100

No matching CI found

No CI found for binding (Failed to resolve the event node to CI id)

Event rule applied: JT Interface

So apart from appearing in additional information, u_group is not configured anywhere in the event rule or in any of the Additional post bind scripts. As mentioned, I exported the customer event rules into a vanilla developer instance where the behaviour works as expected. 

In case they were any artefacts left over in the creation of the event rule, I recreated it by hand on the customer Dev instance, but the same issue remains, hence it would be useful to see any debug logs we could turn on to see why.

Note: The CIs all exist in the right tables on the customer dev instance. The u_group field does not exist in the cmdb_ci_network_adapter table, nor should it.

Jon

[pratiksha5]

Is it posible to do OR in additional info values?  

[Jon Traynor]

OK, so in Transform & Compose, manual attributes has been updated with the u_group field which is why the binding is using it. This has been added dynamically as it doesn't exist in my update set where I created the rule and didn't exist initially in the rule. So the next thing is to figure out why this field is being added to the event rule, perhaps a bug or from the way the event rules were created? I'm opening a support case for this.