How to close events in OBM with logfile policy?

  • KM03637098
  • 30-Apr-2020
  • 12-May-2021

Archived Content: This information is no longer maintained and is provided "as is" for your convenience.

Summary

Using event correlation with logfile entry policy in OBM

Question

In this situation there’s a need to monitor application’s log file that contain entry for each application status change -  when there’s any problem and when this problem is resolved.

 

 

 

Logically, we can create logfile entry policy with two rules:
One will be for the “critical” event and one for the “normal” one.
Both events have reversed “Event Key” and “Close event with Key” – this will assure that only one of these messages will be displayed on OMi/OBM

But here’s the question: why we should have a normal message in OBM if we do not have a problem?

Of course, it would be best if the “Normal” event close itself when it closes the “Critical” event, but the opcle correlation does not provide such functionality.

 

 

Problem – High CPU usage
Resolved – CPU usage is normal
Problem – High CPU usage
Resolved – CPU usage is normal

Answer

What we can do here is to assign any dummy automatic action to the “Normal” event rule.

On the Actions tab, there’s an option that would allow you to auto close the event in case the action is successful.

 

image text

 

As we can see, the automatic action for this event will call C:\temp\script.vbs.

The content of the script C:\temp\script.vbs contains this single line:

 

rem

 

*rem is command used for commenting in VBS script. It will be always successful on Windows.


Since the assigned action does nothing, then it would be always successful and the “Normal” event will acknowledge the “Critical”.
Then it will trigger the dummy action and close itself.