Bind alerts to a specific host CI

Create an event rule to bind alerts to the correct device CI. An incoming event from a device CI can bind to an alert based on event rule transform information. However, first identify the host CI that the device is running on.

Before you begin

Role required: evt_mgmt_admin

About this task

In the binding process, after the host is found, the algorithm matches all additional_info attributes that have the same name as CI fields for that event type. If the match is successful, the event is bound to the CI. If more than one matching device is found on the host, the alert is bound to the host and not the application. Use the following steps to bind alerts to a specific device:

• When binding alerts to a host, such as a computer, switch, or router CI:
  • Populate the Node field in the event with the CI name, FQDN, IP, or MAC address value. The bind is successful even if host has more than one IP address or MAC address.
  • If you want to use a unique identifier that is not one of the four mentioned in the preceding point, populate the event rule CI Identifier (ci_identifier) field with one or more unique identifiers of the CI. This field should be in JSON format. For example, to use a unique identifier that is not one of the four mentioned above, add a CI Identifier (ci_identifier) filter field with one or more unique identifiers of the CI. If the host CI is VMWare VM, and it has a field called MOID, use the JSON format and specify: {"moid":"<CI moid>"}
    Note:

    The node field must be either empty or non-resolvable. If the node field is resolvable, the ci_identifier is ignored.

• Create an event rule with a filter that captures events on the device type you want. In the event rule, select the Transform check box and select the appropriate CI Type:

  Device to bind	CI Type
  File System	cmdb_ci_file_system
  Port	cmdb_ci_network_adapter
  Storage Device	cmdb_ci_storage_device
  Volume	cmdb_ci_storage_volume

Procedure

1. Navigate to All > Event Management > Rules > Event Rules.
2. Select New and fill in the appropriate fields of the event rule.
3. Select the Binding tab.
4. Select Active.
5. From the CI type list, select the device that is used in the filter condition.
   For example, if you build a filter condition for a port, select Port.

   Device to bind	CI type
   File System	cmdb_ci_file_system
   Port	cmdb_ci_network_adapter
   Storage Device	cmdb_ci_storage_device
   Volume	cmdb_ci_storage_volume

6. In the Event Match Fields section, specify any Additional information mappings.
7. Select Submit.
8. To bind to custom device types, configure the alert binding to a process and add the custom device type to the Process to CI Type Mapping [em_binding_process_map] table.

Example

Example showing binding to a specific device using CI field matching to bind to the following string values in the Additional information field of an event: "file_system":"ext2", "mount_point":"mp1".

1. Navigate to Event Management > Rules > Event Rules.
2. Select New, and in Event Rule Info, fill in the appropriate fields of the event rule.

   

3. Select the Binding tab.
   1. Select Override default binding.
   2. In the Binding type field, select CI field matching.
   3. In the CI type field, select File System.

   

4. Select Save.

In the Binding Device Maps [em_binding_device_map] table, ensure that File System is mapped to cmdb_ci_file_system.

In the File Systems [cmdb_ci_file_system] table, ensure that the required values exist, for example, name1 and name2, as depicted in the following image.

The result of the binding performed by the "test binding" event rule is shown in the Processing Notes field of the event.

Related reference

• Alert binding to CIs with event rules