Incomming events are missing value in Severity field - how do I set the value - via Event Rules??

[JanneHjorth]

Hi all.

I'm new to Event Management and at the moment we experience incomming events, where Severity field is empty. So no alerts are created. I have this record:

How can I set a value in Severity field and secure the creation of alerts??

I really need a helping hand here - thanks in advance.

Regards, 

Janne

[Rahul Priyadars]

Hi,

Severity is important Data Point of Event coming from Any Source. Its value like Info, Warning, major, minor Critical etc drives the Priority of Alert/Incident.

Given Screen shot is not of Alert Its on evemt .It is event data em_event table. When any event rule matches then it spawns the ALERT (em_alert).

Please check your Source UMON System as per Screenshot why its not sending the values.

Regards

RP

[JanneHjorth]

Hi Rahul.

There was an error in source event handling. But if I happens again - is it then possible to make sure the Severity field is filled out, så that Alerts can be created??

Regards Janne

[Rahul Priyadars]

Hi

is it then possible to make sure the Severity field is filled out--> Technically it can be but with What Values-Info,Warning,Minor,Major,Critical. Its more of a Functional Call aspect as you can not just fill any Value in Severity in Case its NULL values.

Scenario can be dangerous- Let say event received and it actuality it was Minor but in event table it reached as NULL So what value you will fill. Setting just a Default can be disastrous.

Regards

RP

[dbehnood]

Hi Janne,

Severity needs to be passed as an integer value, and if I recall, they are:

Clear - 0 (this will close the Alert)

Critical - 1

Major - 2

Minor - 3

Warning - 4

Info/OK - 5 (don't ask me why they changed info to OK - it is misleading)

-Dom