Help with Regex in Event Rule

[Dhana1]

Hi,

I need help with regex when I have tested in regex 101 working fine and under Event rule Transform also populating values on right side when used the same regex but populating Unknown vales in Alert.

Please find the below email subject & Body which we are getting in Description and need to write regex to populate 'HQC' as Resource and 'HANA Database Space' as  Metric Name

[Alert: Action Required] HQC_HANA Databases

*External]*



*Customer Communication*

[Alert: Action Required] HQC_HANA Database Space

[image: Customer Communication]

Dear Customer,

*Customer Name:* NorthgateArinso Belgium BV

*CSS Incident: *31169 2024

Below alert was identified for the impacted system, as part of proactive
monitoring.

We analyzed the system and we need the following information/action from
you to resolve this alert.



Alert Name: HANA Database Space



Analysis/Action Required:



This is regarding HQCNG0 system, we received an alert for HANA Data Volume
Usage.

As of now OS space utilization has reached up to 92% for HANA Data mount
point.



From database, we have looked for housekeeping and we couldn't find any old
database backups. Also, data volume reclaim is not possible.

Request customer to evaluate the options for archiving/deletions data based
on business requirements from EWA report. If that option not viable, then
request for additional storage.

Kindly find the below given details and provide approval to increase the
mount point by (AWS 500GB, NON-AWS 200GB) minimum to avoid a
database(default) full situation which can cause system outage.



Impact: There may be an impact on system performance / availability if
there is no action taken.



Please refer to the Incident mentioned in the Email for more details
regarding this alert and our recommendations to resolve the issue.



If there are any further details required about this alert/recommendation,
then please revert to us, or contact your SAP Enterprise Cloud Services
Representative.



*Product Name*

*Affected Entity*

SAP Enterprise Cloud Services

*System Number:*
500403881
*System ID:*
HQC
*System Role:*
Test System

SAP Enterprise Cloud Services

*System Number:*
500403881
*System ID:*
HQC
*System Role:*
Test System

Please refer to the attachment for more details.

*Questions?*

Please contact SAP Support using the Support Hotline
.

I have tried with many regex able to populate 'HQC' as Resource but 'HANA Database Space' is unable to populate it is displaying either unknown or picking up all information after HANA Database Space which is not expected.

[User342536]

Hi @Dhana1 

I have done a slight change in your regex. Problem is the first group was not capturing entire word HQC. Also, please add the variable expressions in the resource and metric name fields.

Screenshots attached.

Kindest Regards,

Please mark the answer as helpful and correct if helped.

Rodrigo Donnangelo

[Dhana1]

Hi,

Thanks for your reply and trying in your instance.

I have tried with modified regex and Alert is still populating unknown values not sure what is missing has spent more than hours for this regex to populate those values but no luck

I am attaching XML's of Email & Event and also screenshots attached.

And also had small query Description in the event is populated as below and during creation of event rule when writing regex in under write regex has been changed both are pasted below.

Description in Event :

[Alert: Action Required] HQC_Disk Space Usage

SAP- Customer Communication

[https://www.sap.com]

Customer Communication
[Alert: Action Required] HQC_Disk Space Usage

Dear Customer,
Customer Name: NorthgateArinso Belgium BV
CSS Incident: 45062 2024

Below alert was identified for the impacted system, as part of proactive monitoring.

We analyzed the system and we need the following information/action from you to resolve this alert.

Alert Name: Disk Space Usage

Analysis/Action Required:

This is regarding "HQCNG0" system, we received an alert for HANA Data Volume Usage.As of now OS space utilization has reached up to 94% for HANA Data mount point.

From database , we have looked for housekeeping and we couldn't find any old database backups/ orphaned volumes. Also data volume reclaim is not possible.

We could see hana data is above threshold. House keeping is not possible from our end because the fragmentation percentage is below 20%.

Housekeeping is not possible from our end.Please do housekeeping from your end.

We Request to evaluate the options for archiving/deletions data based on business requirements to avoid disk full situation.
if not we can extend the file system as its a azure we need to double the size.

Impact: There may be an impact on system performance / availability if there is no action taken.

Please refer to the Incident mentioned in the Email for more details regarding this alert and our recommendations to resolve the issue.

If there are any further details required about this alert/recommendation, then please revert to us, or contact your SAP Enterprise Cloud Services Representative.

Product Name Affected Entity
SAP Enterprise Cloud Services System Number:
500403881
System ID:
HQC
System Role:
Test System
SAP Enterprise Cloud Services System Number:
500403881
System ID:
HQC
System Role:
Test System
Please refer to the attachment for more details.
Questions?
Please contact SAP Support using the Support Hotline [http://service.sap.com/call1sap].

Let’s Run Better Together!
Your SAP Team

EventID: EV36203621, NotifID : NZA5747836

SAP SE | Dietmar-Hopp-Allee 16 | 69190 Walldorf | Germany |
www.sap.com [http://www.sap.com/]
Pflichtangaben/Mandatory Disclosure Statements: https://www.sap.com/impressum [https://www.sap.com/impressum]

Diese E-Mail kann Betriebs- oder Geschäftsgeheimnisse oder sonstige vertrauliche Informationen enthalten. Sollten Sie diese E-Mail irrtümlich erhalten haben, ist Ihnen eine Kenntnisnahme des Inhalts, eine Vervielfältigung oder Weitergabe der E-Mail ausdrücklich untersagt. Bitte benachrichtigen Sie uns und vernichten Sie die empfangene E-Mail. Vielen Dank.

This e-mail is sent to you by SAP SE on behalf of SAP’s legal entities worldwide [https://www.sap.com/dam/site/corporate/legal/sap-legal-entities.pdf] and if you would like to know who your specific data controller is, please click here to e-mail WebMaster@sap.com [mailto:WebMaster@sap.com].

This e-mail may contain trade secrets or privileged, undisclosed, or otherwise confidential information. If you have received this e-mail in error, you are hereby notified that any review, copying, or distribution of it is strictly prohibited. Please inform us immediately and destroy the original transmittal. Thank you for your cooperation.

This e-mail provides material about SAP products and services that are related to your contract.

To ensure you continue to receive SAP related information properly please add SAP CloudSupport Alerts sapcloudsupport@alerts.ondemand.com [mailto:sapcloudsupport@alerts.ondemand.com] to your address book or safe senders list.

Copyright [https://www.sap.com/corporate/en/legal/copyright.html] | Privacy [https://www.sap.com/corporate/en/legal/privacy.html] | Legal Disclosure [https://www.sap.com/corporate/en/legal/impressum.html]

Description in Event rule under Write regex:

[Alert: Action Required] HQC_HANA Databases

*External]*



*Customer Communication*

[Alert: Action Required] HQC_HANA Database Space

[image: Customer Communication]

Dear Customer,

*Customer Name:* NorthgateArinso Belgium BV

*CSS Incident: *31169 2024

Below alert was identified for the impacted system, as part of proactive
monitoring.

We analyzed the system and we need the following information/action from
you to resolve this alert.



Alert Name: HANA Database Space



Analysis/Action Required:



This is regarding HQCNG0 system, we received an alert for HANA Data Volume
Usage.

As of now OS space utilization has reached up to 92% for HANA Data mount
point.



From database, we have looked for housekeeping and we couldn't find any old
database backups. Also, data volume reclaim is not possible.

Request customer to evaluate the options for archiving/deletions data based
on business requirements from EWA report. If that option not viable, then
request for additional storage.

Kindly find the below given details and provide approval to increase the
mount point by (AWS 500GB, NON-AWS 200GB) minimum to avoid a
database(default) full situation which can cause system outage.



Impact: There may be an impact on system performance / availability if
there is no action taken.



Please refer to the Incident mentioned in the Email for more details
regarding this alert and our recommendations to resolve the issue.



If there are any further details required about this alert/recommendation,
then please revert to us, or contact your SAP Enterprise Cloud Services
Representative.



*Product Name*

*Affected Entity*

SAP Enterprise Cloud Services

*System Number:*
500403881
*System ID:*
HQC
*System Role:*
Test System

SAP Enterprise Cloud Services

*System Number:*
500403881
*System ID:*
HQC
*System Role:*
Test System

Please refer to the attachment for more details.

*Questions?*

Please contact SAP Support using the Support Hotline
.

Please help me to fix this regex issue and correct me if am wrong in understanding.

[User342536 · Accepted solution]

Hi @Dhana1 

You have 2 patterns of descriptions. That's because you will have 2 regex exps.

For the description in the event, you can use:

\[Alert: Action Required\]\s(.*?)_(.*?)\s(\w+)\s(\w+).*

For the description you use in the regex (contains html characters), it will be a slight different:

;\[Alert: Action Required\]\s(.*?)_(.*?)\s(\w+)\s(\w+).*

Please make sure the format description in coming from SAP, in order you can build the properly regex. However, you will be forced to build 2 event rules.

Suggest you send raw events to the instance or mid, in order to get real events, and map event rule correctly.

Please mark the answer as helpful and correct if helped.

Kindest Regards,

Rodrigo Donnangelo

[Dhana1]

Hi,

Thanks for your support.