Event Management Policies

Standard event management policy types :Blackout A blackout policy specifies a period of time during which notifications about incoming events that match the event specification criteria are ignored. The blackout events, however, are logged. You can view the blackout events when you open the collector that is specific to the events. For example, on the weekends we can blackout the events related to network notification. Closure closes a specified event in response to receipt of a separate event. For example, when we receive informational event such as cell started we can set this type of event to Closure. Component Based Enrichment enriches the definition of an event associated with a component by assigning selected component slot definitions to the event slots. For example, Intelligent incident service policy ???? Threshold policy A threshold policy specifies a minimum number of duplicate events that must occur within a specific period of time before the cell accepts the event . For example if we want to get cpu utilisation exceeded then notify after 2 duplicate events within 5 seconds of time span if this threshold criteria met then we can get this threshold event. Correlation relates one or more cause events to an effect event, and can close the effect event, The cell maintains the association between these cause-and-effect events. For example, if event such as high-temperature of a device reached then we need to generate event to shut down that specific device.

Enrichment adds values for specific event slots if those slots are empty as received from the event source An enrichment event management policy can also reformat slots or normalize slot values. For example, we can add information regarding location, parameter, or informational message.

Escalation raises or lowers the priority level of an event after a specified period of time A specified number of event recurrences can also trigger escalation of an event. For example, if the abnormally high temperature of a storage device goes unchecked for 10 minutes or if a cell receives more than five hightemperature warning events in 25 minutes, an escalation event management policy might increase the priority level of the event to critical. Notification sends a request to an external service to notify a user or group of users of the event A notification event management policy might notify a system administrator by means of a pager about the imminent unavailability of mission-critical piece of storage hardware. For example, if we want to notify emails to specific users this policy can be used. Propagation forwards events to other cells or to integration to other products. For example, if we want to propagate all critical events to remedy help desk this policy is useful. Recurrence combines duplicate events into one event that maintains a counter of the number of duplicates. For example, if particular event is occurring continuously then we can

specify time span for that event that it should occur in time span of 1 hour. Remote action automatically calls a specified action rule provided the incoming event satisfies the remote execution policys event criteria. For example, if we want to get event corresponding to particular OS running processes such as of unix/windows/solaris we can generate events using this policies.

Suppression specifies which events that the receiving cell should delete Unlike a blackout event management policy, the suppression event management policy maintains no record of the deleted event. For example, if we want to suppress the blackout events this can be generated using this policy. Dynamic enrichment event management policies types:Dynamic enrichment blackout policy :A dynamic enrichment blackout policy specifies external schedules that initiate event blackout. For example, we can blackout after certain parameter matches in .csv file with an execution order of set as 1 Dynamic enrichment location policy :The dynamic enrichment location policy adds location information to an event. For example, we can enrich the event with a locaion specification. Dynamic enrichment service contact policy :The dynamic enrichment location policy adds contact information related to the originating technology to an event.

Dynamic enrichment PATROL message text translation policy:If you are integrated with PATROL, the dynamic enrichment PATROL message translation policy enables you to substitute existing PATROL messages with messages that are meaningful to your enterprise.