After completing the setup instructions and tutorials, including the MMC setup guide,
and the communication routing tutorial, this Event Routing tutorial can be completed. It describes the steps necessary to route events from different sources. The tutorial also contains information on the VA2 Event Routing Wizard.
This tutorial goes over the configuration steps necessary to configure event routing in VA2. The steps up to and including the Notification Rule box will be covered. The creation of Schedules, Administrators, and Communication Servers is covered in the Communication Routing Setup tutorial.
The ability to react to events from disparate sources is one of the main reasons VA2 is used. Once events are generated, if a Notification Rule matches the Event, a communication routine will be routed through the system. In addition, Reactions to events are handled by matching Notification Rules to events.
Events that are generated can be viewed in the VA2 MMC console, under the Events tab.
The screen shot shows where the Events folder is in the MMC Console, and some examples of system generated events.
How are VA2 Events generated? There are 4 methods.
1. VA2 Generated events – built in Event generators cover things like Service Errors, Analysis Rule or Statistic Collector errors – and communication/network problems between the Central Service and LSM hosts.
2. An Analysis Rule that returns a false value will generate event(s).
3. A log file monitoring rule will generate an event if the defined search expression is found in the log file
4. A custom program can be designed to generate events with its own logic, and send the notifications to VA2 via it’s XML-RPC interface.
This tutorial will cover types 2 and 3 Event generating and
reacting to Events. To route and react to Events with VA2, several basic steps are taken:
1. Create and Error Definition
2. Associate an Error Definition with an Analysis Rule, or Log Monitoring
3. Creating a Notification Rule for Events
4. Optionally, create a Reaction for an Event
New, Event Routing Wizard! A VA2 wizard will now walk you through all setps of routing and reacting to events. The manual steps of routing events should be read to understand VA2's Event Routing system. However, the Event Wizard can be used to greatly reduce the steps needed to route VA2 events. Event Wizard instruction here.
To generate events through Analysis Rules and Log File monitoring, an Error Definition must be created first. To create an Error Definition, access the Error Definitions folder in the VA2 MMC console.
To add an Error Definition, right click on the Error Definition folder and choose Add.
The Add dialog will allow you to enter the definition for an Error.
The Error Definition defines what Event will be generated. The Event Level, Event Type, and Event Sub Type will be added into the Events table when the error definition is used to generate an Event.
Error Definitions have a dual role. The Event String is used as a search string for Log File errors. That will be covered in the later section. In the next step of the tutorial, we are going to associate the created Error Definition with an Analysis Rule.
Make sure you read the Analysis Rule tutorial, which covers how to create an Analysis Rule. An Analysis Rule will return a true or false value. If it returns a false value, an Event will be generated. Users can define what type of event is generated for every Analysis Rule. This done by adding an Error Definition to an Analysis Rule.
To add a Error Definition to an Analysis Rule, expand the specific Analysis Rule, and access the “Error Definitions for Analysis Rule” folder.
If the Analysis Rule returns a false value, the defined Error Definition will generate an event as defined by the Error Definition.
Generating an Event from Log Monitoring
VA2 can be easily be used to monitor Log files. To do this, an Error Definition needs to be created, as was seen in step 1 of this tutorial. The second step is to associate the Error Definition to an Application that is defined in VA2.
To add an Error Definition to an application in VA2, navigate to the Managed Software Systems tab, and expand the application you would like to monitor. In this tutorial, we will add an Application Log File Error Definition to the Siebel Gateway server.
Before associating a Log File Error Definition to an Application, you should examine the Application to determine which directory is being monitored for error definitions. To do that, access the application, right click on the application and select edit.
When editing the application, you can determine which directory will be monitored for Error Definitions.
Remember that the defined Log Directory string must end with a \. In this tutorial we will not change the Log Directory, we are just accessing the application to find out which directory will be examined for the defined search string.
By choosing the Add/Remove Error Definition, you can select previously defined Error Definitions and associate an Error Definition with the application.
After a Error Definition has been associated with an Application, if the Search String appears in any file in the directory being monitored, an event will be generated.
In steps 1-2, we have seen 2 ways to generate events. Once an Event is generated, what happens to it? As can be seen from the diagram at the beginning of the tutorial, it is compared to a Notification Rule. If it passes the Notification Rule, the Event is routed to active Schedule(s). In addition, if any Reactions are associated with a Notification Rule, the Reaction is routed. If the Event does not satisfy a Notification Rule, it is stored in the Event table but is not routed anywhere.
To add a Notification Rule, access the Notification Rule folder, right click and press Add.
The Add dialog allows users to define the Notification Rules.
The Name property is user definable, but will be sent to Administrators if the Notification Rule matches the event. The Notify All flag is reserved, and should only be used if your environment wants to route all events, no matter what type, to this Rule. Its use is not recommended.
In a Notification Rule, if a property is filled out, it must match the Event. In other words, if the Event Type, Event Sub Type, and Event Level all have values, all three must match a generated Event to match.
If however, only an Event Type is defined, and there is no values in the Notification Rule for the Event Sub Type or Level, than only the Event Type will be evaluated. In general, if you make sure that a Notification Rule matches an Error Definition, the Notification Rule will satisfy.
If the Notification Rule does match an Event, it will be routed to a Schedule, and then on to defined Administrators and Communication Servers. See the Communication Server setup guide to ensure that your event routing is fully set up.
In steps 1-3, we have seen ways to generate Events, and then route those events into the Communication Channel, if a particular Event matches a Notification rule. This allows users to generate and track Events, but not necessarily react to or be notified of each one. If a Notification Rule does match an Event, administrators will be notified through their defined communication channel. In addition, a Reaction to an Event can be defined and associated with a notification rule.
To add a Reaction, access a particular and Notification Rule , right click and chose Add/Remove Reaction.
The Reaction must be defined first, before adding it to a Notification Rule.
The easiest way to add Event Generators and react to them is by using the VA2
Event Routing Wizard. The Wizard walks you through the necessary and optional steps of event routing:
1. Create and Error Definition
2. Associate an Error Definition with an Analysis Rule, or Log Monitoring
3. Creating a Notification Rule for Events
4. Optionally, create a Reaction for an Event
The Wizard can be launced from several places, which are context sensative:
1. It can be launched while you are creating an Analysis Rule
2. It can be launched from an existing Analyis Rule
3. It can be launced from the Error Definitions folder
4. It can be launced from the Notification Rule folder
Once Launced, the Event Routing Wizard walks you through the necessary steps to
create Error Definitions, Search Log files, send notifications, and create Reactions.
If launched from an Analyis Rule, that Rule will be the default Event Generator. If launched from the Error Definition or Notification Rule folder, the Wizard can be used to create Log File Searches.