Why is Alert CI binding randomly selecting a DNS entry instead of the desired File System or Server entry?

[Katherine Lewis]

The Node contains an FQDN, and all data formats/values are consistent in the event payload.

The event rule will bind to the desired File System CI record with fallback to the Server CI record, but will sometimes bind to the DNS record instead..

The content and format of the desired Server CI records is also consistent.

Also, to answer/preempt some questions:
 - version is Kingston Patch 4
 - and I can confirm we don't have duplicate CI records

Given we have servers that were created by discovery with the following records:

Server A
- Windows server [cmdb_ci_win_server]
 - Name [name] is server-a
 - FQDN [fqdn] is server-a.domain.net
 - SysId is eb9a49cedb225b08d153745bbf96195c

- File System [cmdb_ci_file_system]
 - Name [name] is C:\
 - Mount point [mount_point] is C:\
 - Computer is server-a
 - SysId is 25fc2477dbcfdfc44eb473e9bf961997

- VMware VM Instance [cmdb_ci_vmware_instance]
 - Name [name] is SERVER-A
 - FQDN [fqdn] is empty
 - SysId is c5a4dfe9dbb52200868a7c841f9619ba

- DNS Name [cmdb_ci_dns_name]
 - Name [name] is server-a.domain.net
 - FQDN [fqdn] is server-a.domain.net
 - SysId is 76e05ba9dbb52200868a7c841f961928

Server B
- Windows server [cmdb_ci_win_server]
 - Name [name] is server-b
 - FQDN [fqdn] is server-b.domain.net
 - SysId is 0e926b1dc3100200d8d4bea192d3ae12

- File System [cmdb_ci_file_system]
 - Name [name] is C:\
 - Mount point [mount_point] is C:\
 - Computer is server-b
 - SysId is a72c5181930122005c15d905e67ffbf8

- VMware VM Instance [cmdb_ci_vmware_instance]
 - Name [name] is SERVER-B
 - FQDN [fqdn] is empty
 - SysId is c9edec9c0fc7e200a621fa6ce1050eec

- DNS Name [cmdb_ci_dns_name]
 - Name [name] is server-b.domain.net
 - FQDN [fqdn] is server-b.domain.net
 - SysId is 1dd376fddba21708d153745bbf96199e

And the event rule is configured as follows:

Event Rule Info
- Name is "EventRule01"
 - Source is "EventSource01"
- Order is "100"

And Event Filter
- Ignore is Unchecked
- The following conditions must be met:
 - Type is "EventTypeName01"
 - Metric name is "EventMetricName01"

And Transform and Compose Alert Output
- Configure as follows:
 - Description is ${description}
 - Node is ${node}
 - Type is ${type}
 - Resource is ${resource}
 - Message Key is left blank
 - Severity is ${severity}
 - Metric Name is ${metric_name}
 - Source Instance is ${event_class}
 - Source is ${source}
 - Classification is ${classification}

 - Manual attributes is Checked
  - mount_point = ${resource}\

And Threshold
- Active is Unchecked

And Binding
- Override default binding is Checked
- Binding Type is "CI field matching"
- CI Type is "File System"

When an Event record is created with the following values:
 - Node is "server-a.domain.net"
 - Resource is "c:"
Then the Alert will correctly bind to the File System CI record related to with server-a
 And the Processing Notes are as follows:
  - Binding alert CI process flow:
  - Node is FQDN
  - Node was not found, checking by name
  - Node will be resolved to CI id: eb9a49cedb225b08d153745bbf96195c : found by node name
  - Event CI type is cmdb_ci_file_system
  - Query with fields:
  - mount_point : c:\
  - The event CI type is device, trying to check for matching device
  - Found matching device (using type: cmdb_ci_file_system defined in em_binding_device_map table)
  - Bounding will be done with a matching device (id): 25fc2477dbcfdfc44eb473e9bf961997
  - Bind to 25fc2477dbcfdfc44eb473e9bf961997

  - Event rule applied: EventRule01

When an Event record is created with the following values:
 - Node is "server-b.domain.net"
 - Resource is "c:"
Then the Alert will incorrectly bind to the DNS Name CI record for server-b
 And the Processing Notes are as follows:
  - Binding alert CI process flow:
  - Node is FQDN
  - Event CI type is cmdb_ci_file_system
  - Query with fields:
  - mount_point : c:\
  - The event CI type is device, trying to check for matching device
  - No matching CI found
  - No related CI found for binding, alert CI will be bound to node (id): 1dd376fddba21708d153745bbf96199e
  - Bind to 1dd376fddba21708d153745bbf96199e

  - Event rule applied: EventRule01

[manivk]

Kindly share the processing notes from the  events for both cases which can provide some helpful information

[Katherine Lewis]

I've updated the original question with the Processing Info.

I'm hoping the issue is something obvious I've overlooked.

[Michael Skov2]

Is there any information the processing info of the event?

[Michael Skov2]

1. How are the events created? Manually or from a connector?

2. Try using the API to create an event. I have found differences in events created using a connector and the API.

[manivk]

First server 'server-a' is binding to correct CI class windows server and second one server-b binding to DNS name which is incorrect

Please provide following info

a)go to cmdb_ci.list and type 'server-a' in name field. It will list all CI's for server-a

b)a)go to cmdb_ci.list and type 'server-b' in name field. It will list all CI's for server-b

We need to compare them both.

Also, it should not bind to DNS name by default unless someone changed the CI identifiers.Kindly go to  CI identifiers and search for 'Hardware Rule' and find  any DNS name in identification entries. or share the screen-shot (these are not confidential data)