Table of Contents
#1 Trigger event genereren
Overzicht
Verandering van trigger status is de meest voorkomende en belangrijkste bron van evenementen. Elke keer dat de trigger van status verandert, wordt een gebeurtenis gegenereerd. De gebeurtenis bevat details van de verandering van de trigger status - wanneer het gebeurde en wat de nieuwe staat is.
Er worden twee soorten gebeurtenissen gecreëerd door triggers: Probleem en OK.
Probleem events
Er wordt een probleem event aangemaakt:
- wanneer een trigger-expressie WAAR is als de trigger in OK stand staat;
- elke keer dat een trigger-expressie WAAR is als meervoudig probleem event generatie is ingeschakeld voor de trigger.
OK events
Een OK-event sluit de gerelateerde probleem event(s) en kan worden gemaakt door 3 componenten:
- triggers - op basis van 'OK-event generatie' en 'OK-event wordt gesloten' instellingen;
- event correlatie
- taakbeheer – wanneer een gebeurtenis handmatig . is gesloten
Triggers
Triggers have an 'OK event generation' setting that controls how OK events are generated:
- Expression - an OK event is generated for a trigger in problem state when its expression evaluates to FALSE. This is the simplest setting, enabled by default.
- Recovery expression - an OK event is generated for a trigger in problem state when its expression evaluates to FALSE and the recovery expression evaluates to TRUE. This can be used if trigger recovery criteria is different from problem criteria.
- None - an OK event is never generated. This can be used in conjunction with multiple problem event generation to simply send a notification when something happens.
Additionally triggers have an 'OK event closes' setting that controls which problem events are closed:
- All problems - an OK event will close all open problems created by the trigger
- All problems if tag values match - an OK event will close open problems created by the trigger and having at least one matching tag value. The tag is defined by 'Tag for matching' trigger setting. If there are no problem events to close then OK event is not generated. This is often called trigger level event correlation.
Event correlation
Event correlation (also called global event correlation) is a way to set up custom event closing (resulting in OK event generation) rules.
The rules define how the new problem events are paired with existing problem events and allow to close the new event or the matched events by generating corresponding OK events.
However, event correlation must be configured very carefully, as it can negatively affect event processing performance or, if misconfigured, close more events than intended (in the worst case even all problem events could be closed). A few configuration tips:
- always reduce the correlation scope by setting a unique tag for the control event (the event that is paired with old events) and use the 'new event tag' correlation condition
- don't forget to add a condition based on the old event when using 'close old event' operation, or all existing problems could be closed
- avoid using common tag names used by different correlation configurations
Task manager
If the 'Allow manual close' setting is enabled for trigger, then it's possible to manually close problem events generated by the trigger. This is done in the frontend when updating a problem. The event is not closed directly – instead a 'close event' task is created, which is handled by the task manager shortly. The task manager will generate a corresponding OK event and the problem event will be closed.