Users Guide

Automation and Event Processing Rules | Alarms, Events, and Automation
OMNM 6.5.3 User Guide 303
The following types are processing rule types and a description of their properties.
Rule Type Properties
Protocol Translation These rules define how to translate messages that are received from protocols
other than SNMP into a format that is more similar to an SNMP trap so that
they can become events in OpenManage Network Manager. SNMP traps
always have all of the data in their payload contained within variable bindings,
and this is also the way events are structured within OpenManage Network
Manager so for the system to be able to have events that come from protocols
other than SNMP, they first have to undergo this translation. Currently the
only rule type within this category is Syslog Escalation, and rules of this type
translate incoming syslog messages into a payload that is more similar to an
SNMP trap so that they can become events based on the definition
syslogNotification.
Stream Based
Correlation
These rules allow you to control the stream of events that are processed. You
can do this by specifying a correlation pattern that the system should detect
among the events within the stream and then also specifying the action that
the system should take to modify the stream in some way. Correlation patterns
can take into account the frequency of certain types of similar events (as is the
case for Frequency Threshold rules) or they can operate on the intermittent
fluttering of the raising and clearing of certain types of alarms (as is the case for
State Flutter rules). You can use rules of types within this category for the
purpose of minimizing the number of events submitted to the application
server for further processing.
Event Definition
Override
By default, events inherit all of their attributes (such as severity, behavior, etc.)
directly from the event definition identified by the notification type OID.
These rules allow you to override the default attributes such as severity (Set
Severity), service affecting (Set Service Affecting), and/or behavior (with rules of
the type Reject Event or Suppress Alarm). Device Access rules also fall into this
category because you can use rules of this type to normalize the device-specific
events into standardized events.
Automation These rules execute specified actions for the rule after the event processing
occurs. Note that Automation is both a rule category and a rule type since there
is only one type of rule within this category.
The following are Event Definition Override rule types:
• Reject Event — This screen presents the Specify Event Filtering portion of
the screen without any Settings in the lower screen. Specify events to reject
with this selection and filtering.
• Set Severity — This rule overrides the default alarm severity of an event
selected and filtered in the upper screen.
• Suppress Alarm — This screen presents the Specify Event Filtering portion
of the screen without any Settings in the lower screen. Specify events/alarms
to suppress with this selection and filtering.