Table Of Contents
Creating a Monitor Box Indicator With the Trigger Condition
Activating or Deactivating the Trigger
Entering an Action Description
Associating Triggers and Actions
Importing and Exporting Automations and Actions
Exporting Automations and Actions
Importing Automations and Actions
Flashing Unacknowledged Alerts
Trigger Condition to Start Flash
Trigger Condition to Stop Flash
Automation
This chapter describes the Cisco Info Center automation system. It includes the following sections:
•
Importing and Exporting Automations and Actions
For detailed technical and best-practices information for automations, see Automation Reference.
Introduction
Automation allows you to search for a condition and then perform an action automatically when the condition is met.
You can use automations to manage alerts stored in the Cisco Info Server. For example, an automation can delete all alerts having a severity of "clear" and that have been in the system longer than a specific period of time.
You can also use automations to change alert data or run external commands if certain alerts occur in the Cisco Info Server. For example, if there are critical alerts in a network, you could use an automation to e-mail a person after a specific period of time.
Automations consist of the following:
•
•
Cisco Info Server SQL
Standard Query Language (SQL) is used for manipulating and extracting information from databases. In Cisco Info Center, SQL is used to control the various automation mechanisms. Cisco Info Server SQL is a sub-set of standard SQL.
Note
Triggers
A trigger is a mechanism for detecting when an automation action should be activated. Triggers use a filter to interrogate the alerts.status table. When alerts match the filter, the associated automation action is activated.
When any alert matches the filter, the trigger is said to be primed, as shown in Figure 4-1.
Figure 4-1 Trigger Operation
Links to Actions
Each trigger can be linked to two types of actions:
•
•
Types of Triggers
The trigger type is defined by the way it calls the action. The following list shows the four different types of triggers:
•
•
•
•
These trigger types are described in detail in Automation Reference.
Actions
Actions define responses to states and can make changes to alerts in the Cisco Info Server. They can also make calls to external programs. Actions can consist of an SQL statement, an executable, or both. Actions can be called by a trigger once or many times, depending on the execution mode of the trigger.
When an action is called, all the fields from the alert being used to call it are available. They may be substituted as @<fieldname> where <fieldname> is the name of a field in an alert record.
The default fields are:
Other fields may be available if the Cisco Info Server has had fields added to it.
SQL Statement
The SQL statement consists of a Cisco Info Server SQL statement or statements, which manipulate the data held in the Cisco Info Server tables.
Executable
The executable consists of UNIX commands or an external application.
Configuring Automations
Use the Automations tab in the Configuration Manager to configure automations. Figure 4-2 shows an Automations tab.
Figure 4-2 Configuration Manager - Automations Tab
Automations Tab
The Automations tab displays all triggers existing in the Cisco Info Server to which you are connected. Triggers are identified by an icon representing the trigger configuration. This is followed by the name of the trigger, the sample rate, and the row count threshold values.
Table 4-1 contains the types of triggers and the icons representing them.
When you click a trigger, the trigger description is displayed at the bottom of the window.
Trigger Actions
To display the action associated with a particular trigger, double-click the trigger. Associated actions are shown below the trigger and indented to the right.
The action icon identifies the action type. The action can be:
•
•
•
•
The action icons are described in Table 4-2.
The arrow on the action icon identifies the action as ascending or descending. A blue upward arrow indicates the ascending action to be called. A red downward arrow indicates the descending action to be called.
Actions Window
To open the Actions window from the Automations tab, do one of the following:
•
choose Trigger > Edit Actions or
•
To display the trigger or triggers associated with a particular action, double-click an action. Associated triggers are shown below the action and are indented to the right.
Figure 4-3 shows the Actions window.
Figure 4-3 Actions Window
A description of the selected action or trigger is displayed in the bottom of the window. Actions are identified by an icon, as shown in Table 4-2.
Configuring Triggers
A trigger is a mechanism for detecting when an automation action should be activated. For information about how a trigger is used in an automation, see Triggers.
Creating a Trigger
To create a new trigger, select one of the following options from the Automations tab:
•
choose Trigger > New or
•
The New Trigger window appears. An example is shown in Figure 4-4.
Complete the three tabs in the New Trigger window, as described below
Additions and changes to triggers, including changing the Active option, do not become effective until you click OK and close the New Trigger window.
Editing a Trigger
To edit a trigger, select one of the following options from the Automations tab:
•
choose Trigger > Edit or
•
The Edit Trigger window appears. The Edit Trigger window is identical to the New Trigger window except the Name field appears in gray and cannot be modified.
Complete the three tabs on the Edit Trigger window, as described in Table 4-4.
Additions and changes to triggers, including changing the Active option, do not become effective until you click OK and close the Edit Trigger window.
Entering a Trigger Condition
Use the Condition tab to enter the conditions used to set the trigger status.
The main text pane of the Condition tab contains an SQL statement that is applied to a table in the Cisco Info Server. This statement can be used to filter the table and start an action. The trigger filter and the action command can also be combined in the SQL text.
Figure 4-4 shows the New Trigger window Condition tab.
Figure 4-4 New Trigger Window - Condition Tab
To complete the Condition tab, enter the information for the window items shown in Table 4-5.
Table 4-5 New Trigger and Edit Trigger Window Condition Tab Items
Name
Enter a unique name for the new trigger.
When you are editing an existing trigger, the name appears in gray and cannot be modified.
This field appears on each tab of the New Trigger and Edit Trigger windows.
Active
Select this check box to activate the trigger. The trigger is only activated or deactivated when you click OK and close the window.
Icons for inactive triggers appear in gray on the Automations tab.
This check box appears on each tab of the New Trigger and Edit Trigger windows.
Sample Rate
Enter a sample rate value, in seconds. For example, if the sample rate is set to 60 seconds, the SQL inside the automation trigger is executed every 60 seconds and the results are evaluated to see if the trigger should fire.
For more information about sample rates, see Sampling and Timing.
Note
Row Count
Select an option and enter a value for comparison. After the trigger samples the alerts.status table, the number of matched rows is held as a variable row count. The trigger condition compares this variable to the entered value. The available options are:
•
•
•
•
•
SQL Statement Builder button. For information about using this button, see SQL Statement Builder Button.
Column Names button. For information about using this button, see Column Names Button.
Conversion Names button. For information about using this button, see Conversion Names Button.
Start Filter Builder button. For information about using this button, see Start Filter Builder Button.
Test Filter button. For information about using this button, see Testing the Trigger.
Testing the Trigger
When you click the Test Filter button, the SQL statement is used to create a filter. The SQL syntax is checked automatically for errors. If errors are found, an error is displayed describing the nature of the error. If the error is in the syntax, a Parse Error message is displayed. You are returned to the window in order to correct the error.
After the SQL statement has been checked, an Event List is opened. The content is based on the WHERE clause in the trigger condition and uses the default view.
Creating a Monitor Box Indicator With the Trigger Condition
In addition to the default Event List window options, the Event List created when testing a trigger contains the menu option File > Keep Window. If you choose this option, a new monitor box with the name given to the trigger is added to the monitor box window.
If you click the Test Filter button again, this monitor box is removed. You must choose
File > Keep Window again to restore the monitor box.For detailed information about monitor boxes, see the Cisco Info Center User Guide, 3.6.
Adding Trigger Settings
Use the Settings tab to enter the conditions defining when an action should run. Figure 4-5 shows the New Trigger window Settings tab.
Figure 4-5 New Trigger Window - Settings Tab
To complete the Settings tab, complete the information for the window items listed in Table 4-6.
Table 4-6 New Trigger and Edit Trigger Window Settings Tab Items
Name
For a description of this field, see Table 4-5.
Active
For a description of this check box, see Table 4-5.
Type
Select the trigger type from the pull-down list. The trigger types are:
Edge—this trigger calls its ascent action only when the number of matched rows equals a specified number. The trigger does not call another action, except when you specify a descent action. A descent action is called when the number of matched rows falls to zero or a specified number.
Level—this trigger calls its ascent action at given intervals as long as the number of matched rows is at least a specific number.
Delayed Edge—this trigger works in the same way as the edge trigger except when the number of matched rows increases from zero to a specific number, the trigger waits for a specified delay period. If the condition still matches the action, it is called and the trigger continues as an edge trigger.
Delayed Level—this trigger works in the same way as the level trigger except when the number of matched rows increases from zero to a specific number, the trigger waits for a given delay period. If the condition still matches after the delay, the action is called and the trigger continues as a level trigger.
Mode
Select the execution mode from the drop-down list.
For Each Matched Row—sets the trigger to execute its action once for every alert that matches the trigger conditions. This mode allows for a many-to-many mapping between particular alerts and actions taken.
Once Only—sets the trigger to execute its actions once regardless of the number of matched rows in the temporary table. This allows only a one-to-one mapping between the overall state and the action taken.
Ascent
Select an ascent action from the drop-down list or enter the name of a new action. The ascent action is executed on the upward edge of an edge trigger or while the trigger status is true on a level trigger. You can also use the delayed edge and delayed level triggers to delay the ascent action.
Select the None action if you do not require an ascent action.
To create a new action, click the New button to open the New Action window. If you select an existing action, click the Edit button to open the Edit Action window.
For information about creating and editing actions, see Configuring Actions.
Descent
Select a descent action from the drop-down list or enter the name of a new action. The descent action is executed on the downward edge of an edge trigger. A descent action is only called for an edge trigger and a delayed edge trigger.
Select the None action if you do not require a descent action.
To create a new action, click the New button to open the New Action window. If you select an existing action, click the Edit button to open the Edit Action window.
For information about creating and editing actions, see Configuring Actions.
Adding a Trigger Description
The Description tab allows you to enter a description of the trigger. The description does not affect the trigger operation. Figure 4-6 shows the New Trigger window Description tab.
Figure 4-6 New Trigger Window - Description Tab
Activating or Deactivating the Trigger
To activate or deactivate a trigger, do the following:
Step 1
Step 2
Trigger icons for disabled triggers appear gray. For more information, see Table 4-5.
Renaming a Trigger
To rename a trigger:
Step 1
Step 2
The Rename Trigger window appears.
Step 3
Step 4
Clearing Trigger Associations
To clear the association between a trigger and an action:
Step 1
a.
choose Trigger > Edit Actions or
b.
The Actions window appears.
Step 2
Step 3
Step 4
Deleting Triggers
To delete a selected trigger, do one of the following from the Automations tab:
•
choose Trigger > Delete or
•
Configuring Actions
Actions are used in automations to define responses to alert states. They can incorporate changes to the Cisco Info Server's managed objects and make calls to external programs.
For information about how actions are used in automations, see Actions.
Creating an Action
To create a new action:
Step 1
a.
choose Trigger > Edit Actions or
b.
The Actions window appears.
Step 2
a.
choose Action > New or
b.
Note
Step 3
Additions and changes to actions, including changing the Active option, do not become effective until you click OK and close the New Action window.
If an error is found, a warning message is displayed. The New Action window remains open to allow you to correct the error. If there are no errors, the window is closed and the action saved.
Editing an Action
To edit an action:
Step 1
a.
choose Trigger > Edit Actions or
b.
The Actions window appears.
Step 2
a.
choose Action > Edit or
b.
The Edit Action window appears. The Edit Action window is identical to the New Action window except the Name field appears in gray and cannot be modified.
Step 3
Additions and changes to actions, including changing the Active option, do not become effective until you click OK and close the Edit Action window.
If an error is found, a warning message is displayed. The Edit Action window remains open to allow you to correct the error. If there are no errors, the window is closed and the action saved.
Entering Action in SQL
If you are creating or editing an internal action, enter it on the SQL tab. Figure 4-7 shows the New Action window SQL tab.
Figure 4-7 New Action Window - SQL Tab
To complete the SQL tab, complete the information for the following window items described in Table 4-9.
Table 4-9 New Action and Edit Action Window SQL Tab Items
Name
Enter a unique name for the new action.
When you are editing an existing action, the name appears in gray and cannot be modified.
This field appears on each tab of the New Action and Edit Action windows.
Journal
When selected, a journal entry is made for every alert that matches the trigger condition of the trigger which executed the action.
The journal entry is in the following format:
Action <action_name> updated eventwhere <action_name> is the name of the action. The addition to the journal is automatically time stamped.
This check box appears on each tab of the New Action and Edit Action windows.
Active
Select this check box to activate the internal action. The action is only activated or deactivated when you click OK and close the window.
Text window
Enter an SQL statement for the action. When the SQL for the action is executed, the commands update the entire Cisco Info Server table, not just the records selected in the trigger.
To update only the alerts returned by the trigger, use the @ <field names>. For example, the following statement sets the Severity to 4 (Major) on only those alerts returned by the trigger:
update alerts.status set Severity=4 where Serial=@Serial;
The SQL statement must end with a semicolon.
The SQL statement is validated when the Active check box is selected and you click OK to close the window. If an error is found, a warning message is displayed. The window remains open to allow you to correct the error. If there are no errors, the window is closed and the action is saved.
SQL Statement Builder button. For information about using this button, see SQL Statement Builder Button.
Column Names button. For information about using this button, see Column Names Button.
Conversion Names button. For information about using this button, see Conversion Names Button.
Start Filter Builder button. For information about using this button, see Start Filter Builder Button.
Note
Entering an Action Executable
If you are creating or editing an external action, indicate the command to run on the Executable tab. Figure 4-8 shows the New Action window Executable tab.
Figure 4-8 New Action Window - Executable Tab
To complete the Executable tab, complete the information for the window items described in Table 4-10.
Table 4-10 New Action and Edit Action Window Executable Tab Items
Name
For a description of this field, see Table 4-5.
Journal
For a description of this field, see Table 4-5.
Active
Select this check box to activate the external action. The action is only activated or deactivated when you click OK and close the window.
Executable
Enter the full path name of the executable to be run. The command can include environment variables.
For example, possible commands are:
/usr/application/bin/<program_name>
$NETSOFT/bin/<program_name>
Arguments
Enter the arguments to be passed to the executable program when it is run. The arguments can use @ to reference fields as in an SQL statement. For example:
-node @Node -error @Summary -severity @Severity
Host
Enter the name of the host machine on which the executable should be run. The host must have a Process Control agent running on it for this to work.
The Process Control agent can manage any process, not only Cisco Info Center components. It can be placed on a system specifically so automation's external effects can be carried out on that system.
User ID
An executable may require specific user privileges to run on the destination machine. Enter the user identifier with which to run this executable.
The process agent on the destination machine must have root privileges in order to assign the executable to a specified user ID.
Note
Entering an Action Description
The Description tab allows you to enter a description of the action. The description does not affect the action operation.
Figure 4-9 shows the New Action window Description tab.
Figure 4-9 New Action Window - Description Tab
Associating Triggers and Actions
Step 1
a.
b.
A sub-menu appears, which provides the following options:
•
•
•
•
•
Where <action_1>, <action_2>, and <action_n > represent the actions defined in the Cisco Info Server to which you are connected.
Step 2
You can also associate a trigger with an action from the Edit Trigger window Settings tab (see Adding Trigger Settings).
Associated icons appear below the trigger and action on each window.
Copying an Action
To create a new action based on an existing action, copy the action in the Edit Actions window. The content of the new, copied action is identical to the source action; you can edit the new action as required.
To copy an action, from the Automations tab:
Step 1
a.
choose Trigger > Edit Actions or
b.
The Actions window appears.
Step 2
Step 3
A popup prompt appears requesting a name for the copy.
Step 4
The new action is added. You need not paste it.
Renaming an Action
To rename an action from the Automations tab:
Step 1
a.
choose Trigger > Edit Actions or
b.
The Actions window appears.
Step 2
Step 3
The Rename Action window appears.
Step 4
Step 5
Deleting Actions
To delete an action from the Automations tab:
Step 1
a.
choose Trigger > Edit Actions or
b.
The Actions window appears.
Step 2
a.
b.
Importing and Exporting Automations and Actions
This section contains information about importing and exporting automations and actions from the Cisco Info Server.
Exporting Automations and Actions
You can export automations or actions from the Automations tab or from the Actions window.
Step 1
a.
b.
Figure 4-10 shows an example Export Automations window.
Figure 4-10 Export Automations Window
The triggers are listed in the left column and the actions are listed in the right column (see Table 4-1).
Step 2
Only selected items will be exported. You can press the Ctrl key to select multiple items.
Step 3
A standard file manager window appears.
Step 4
The default filename extension is .auto.
There is a Save Existing Files check box on the File Manager. When this check box is selected, you are prevented from overwriting an existing file.
Step 5
Importing Automations and Actions
You can import automations and actions from an exported automations file into a Cisco Info Server. To do this:
Step 1
a.
b.
A file selection window appears.
Step 2
The default file extension is .auto.
Step 3
Automation Examples
This section contains example automations, with details of their triggers and actions. For additional automation examples, see "Automation Reference.".
Deleting Cleared Alerts
The following example automation deletes all alerts that are cleared and have been in the system for longer than 10 minutes. You should set the trigger type to level.
Trigger Condition
select * from alerts.status where (Severity=0) and
(LastOccurrence < (getdate -600));Action
delete from alerts.status where Serial = @Serial;Flashing Unacknowledged Alerts
The following example automation shows how to set the trigger conditions to make the alerts that have not been acknowledged, flash in the Event List. For both of the following trigger conditions, you should set the sample rate to 10 and set the trigger type to level.
The first trigger condition sets the alert to flash when it has not been acknowledged. The second trigger condition stops the alert flashing when the alert has been acknowledged.
Trigger Condition to Start Flash
update alerts.status set Flash=1 where Acknowledged=0;Trigger Condition to Stop Flash
update alerts.status set Flash=0 where Acknowledged=1;
