Users Guide

Automation and Event Processing Rules | Alarms, Events, and Automation
OMNM 6.5.3 User Guide 305
one event. If it receives six events then it publishes two events (because this amounts to 3
times 2).
State Flutter —This type of rule changes event behavior on transient raising/clearing state changes
for events that are correlated to each other. For example, if there is a series of flapping linkUp
and linkDown events for the same interface, but you do not want the alarm state of this
interface to change rapidly, then you can use a rule of this type to filter out the noise so that
the alarm state reflects the most common state of the interface. When rules of this type are
configured, the system looks for successive raising and clearing events that correlate to each
other and are associated with the same entity and it publishes the final state in after a given
number of seconds has elapsed and it suppresses or rejects the extra events..
To create a rule of this type, you will need to associate it with at least one raising and/or
clearing event definition. You can include more than one raising and/or more than one
clearing, but for an event to be affected by this type of rule, it must have a correlated pair to
another event definition. To add event definitions to the rule, when you are on the Filter tab
of the edit screen, click the Add button within the upper panel and select event definitions
that correlate to each other through raising/clearing correlation. If you need to look up this
information, you can go to the Event Definitions portlet and bring up the edit screen for any
given event definition and then navigate to the Correlations tab. Examples of pairs of event
definitions that are related to each other through raising/clearing correlation include linkUp/
linkDown, monitorTargetUp/monitorTargetDown, among many others.
After you select the event definitions and also enter any additional filtering as desired,
navigate to the Setting tab and enter the Interval (seconds) and the Action (Reject or
Suppress the event). If you Reject an event, it does not appear in Event history; if you
Suppress it then it creates no alarm but it does appear in the Event history. Check Publish
Event if you want OpenManage Network Manager to keep a record of when this rule starts
and stops filtering events.
OpenManage Network Manager always publishes the first raising event matching the given
filter criteria. When OpenManage Network Manager receives a correlated event (either the
raise or the clear), this activates the State Flutter rule pattern, which will then expire after the
given number of seconds has elapsed. Until the pattern expires, it holds all correlated rising
and clearing events. This way if the state goes from raise to clear and back to raise in rapid
succession, the result will be the final state after the number of seconds has elapsed, but
without publishing the extra events and/or creating the alarms.
The following type is the
Protocol Translation rule type :
Syslog Escalation —This screen presents the Specify Event Filtering portion of the screen without
any
Settings in the lower screen. Specify events to select. Then click Next to go to the
Escalation tab.
Automation rules let you modify the Specify Event Filtering portion of the screen without any
Settings in the lower screen. Specify events to select. Then click Next to go to the Actions tab. See
Actions on page 310 for more about that feature.