[INUG-Users] Automation Help

[trefalgar at realitybytes.net]

Thinking about this further, didn't I write the IRIS integration?

If I remember correctly, there were only severity 5 and severity 0  
events. Severity 0 events were deleted about 5 minutes after they came  
in, based on delete clears. The severity 5 events had to be either  
manually deleted, or severity changed to 0, as they were not a Type=1  
event.

Or was the script changed? ;)

That said, the webtop users shouldn't have access to "delete" an  
event, and the "delete tool" should only change the severity of the  
event to 0 and set a journal entry. I can't remember, but you might  
want to check if this is still the case.

Jacob

Quoting trefalgar at realitybytes.net:

> Looks like you're set on generic clear ...
>
>
>> 3.) ACS_AC_GenericClear_Correlate_Status_Table
>>      ** Condition: select * from alerts.genclr_journal_table
>>                    where Resolved = 1;
>>
>>      ** Action: update alerts.status via '@Identifier' set Severity = 0
>>                 where ACSOSGroup = 6 and LastOccurrence <= @LastOccurrence;
>>
>>                 insert into alerts.journal(KeyField, Serial, UID, Chrono,
>> Text1) values ('@Serial:@OwnerUID:@StateChange',
>>                 @Serial, @OwnerUID, getdate, 'This event has been cleared by
>> the Generic Clear automation at ORLOS2');
>
>
> The insert into alerts.journal should, well, insert a journal entry
> every time an event is cleared by it. Do you not see those updates?
>
>
>> 4.) ACS_Expire
>>      ** Condition: select * from alerts.status where ACSOSGroup = 6
>>                    and ExpireTime > 0 and Severity > 0 and Acknowledged = 0;
>>
>>      ** Action: update alerts.status via '@Identifier' set Severity = 0
>> where LastOccurrence < (getdate - @ExpireTime);
>
>
> This being a two part automation has always bugged me. It would be
> faster to skip the select ...
>
> update alerts.status set Severity = 0 where ACSOSGroup = 6 and
> ExpireTime > 0 and Severity > 0 and Acknowledge = 0 and LastOccurrence
> < (getdate - ExpireTime);
>
> Either way, I think you should be able to check the journal box
> without having to worry about it touching every event.
>
> Jacob
>
> _______________________________________________
> Sent by the netcoolusers.org "users" mailing list
> Post: users at netcoolusers.org
> Unsubscribe: users-unsubscribe at netcoolusers.org
> Search: http://lists.netcoolusers.org/archives/users/
>