Examples of suggestion definition file (imdd_suggestion_arbitrary-character-string.conf)
The following shows examples of how to specify suggestion activation criteria and response actions configured in the suggestion definition file (suggestion template).
- Organization of this page
Example of displaying a report for identifying the causal process when CPU usage surges
The following shows an example of displaying a report for identifying the causal process when CPU usage surges in the IM management node that corresponds to performance data of PFM - Agent for Platform (Windows).
- Prerequisites
-
An agent for PFM - Agent for Platform (Windows) binds the following alarm that monitors CPU usage:
Alarm table name: Windows Template Alarms [CPU] 09.00
Alarm name: CPU Usage
-
The following report is displayed as a report for identifying the causal process:
Report name: /Windows/Operating System/Troubleshooting/Real-Time/CPU Usage - Top 10 Processes
Report ID: ac102ccb:1daa55:ebc5900de6:-79be
- Example of specifying the suggestion activation criteria and response actions
"suggestions":[
{
"suggestionId":"jp1_pfm_display_report_for_Windows",
"label":"Show a report that identifies processes with high CPU usage.",
"node":"_CATEGORY_[^m].*_OBJECT_JP1PFM-AT",
"permissions":[
["JP1_PFM_Operator"],
["JP1_PFM_Admin"]
],
"cases":[
[
{
"type":"plugin",
"key":{
"sid":"${.:tree:sid:}",
"method":"jp1pfmSuggestionGetAllAlarmStatuses",
"args":{}
},
"ope":"NOTIN",
"val":"",
"description":"The acquisition of status of all alarms ended successfully."
},
{
"type":"plugin",
"key":{
"sid":"${.:tree:sid:}",
"method":"jp1pfmSuggestionGetAlarmStatus",
"args":{
"allAlarmStatuses":"${:plugin[1]::}",
"alarmTableName":"Windows Template Alarms [CPU] 09.00",
"alarmName":"CPU Usage"
}
},
"ope":"REGEX",
"val":"Exception|Warning",
"description":"The status of the CPU usage monitoring alarm is Warning or Abnormal."
},
{
"type":"plugin",
"key":{
"sid":"${.:tree:sid:}",
"method":"jp1pfmSuggestionCreateReportURL",
"args":{
"reportId":"ac102ccb:1daa55:ebc5900de6:-79be"
}
},
"ope":"NOTIN",
"val":"",
"description":"Report URL generated successfully."
}
]
],
"action":{
"type":"jump",
"params":{
"url":"${:plugin[3]::}"
},
"description":"Display the top 10 processes with the highest CPU usage in real-time."
}
}
]Example of changing the response status of an event to Processed when the status of the alarm or agent is recovered to normal
The following shows an example of changing the response status of an event to Processed when a JP1 event on the status of an alarm or agent was issued on the IM management node that corresponds to performance data of the monitoring agent, but the status has currently been recovered to the normal state.
- Prerequisites
The response status of an event within the past 24 hours from the current time should be changed to Processed.
- Example of specifying the suggestion activation criteria and response actions
"suggestions":[
{
"suggestionId":"jp1_pfm_set_status_of_events_to_processed",
"label":"If a status is recovered, set the event status to Processed.",
"node":"(_CATEGORY_[^m].*_OBJECT_JP1PFM-A|_OBJECT_JP1PFM-A.*%5BAll%40|_OBJECT_JP1PFMMGR)",
"permissions":[
["JP1_PFM_Admin"]
],
"cases":[
[
{
"type":"plugin",
"key":{
"sid":"${.:tree:sid:}",
"method":"jp1pfmSuggestionGetPerformanceEvents",
"args":{
"startTime":"${:time:-24.h.:}",
"endTime":"${:time::}"
}
},
"ope":"NOTIN",
"val":"[]",
"description":"Within the past 24 hours, there is an alarm event or an agent status changed event which has defined as Severe Event with the status of Unprocessed."
},
{
"type":"plugin",
"key":{
"sid":"${.:tree:sid:}",
"method":"jp1pfmSuggestionGetAllAlarmStatuses",
"args":{}
},
"ope":"NOTIN",
"val":"",
"description":"The acquisition of status of all alarms ended successfully."
},
{
"type":"plugin",
"key":{
"sid":"${.:tree:sid:}",
"method":"jp1pfmSuggestionGetCurrentlyNormalEvents",
"args":{
"events":"${:plugin[1]::}",
"allAlarmStatuses":"${:plugin[2]::}"
}
},
"ope":"NOTIN",
"val":"[]",
"description":"There is an alarm or agent whose current status is normal. (There are some events that can be changed the event status to Processed.)"
}
]
],
"action":{
"type":"plugin",
"params":{
"sid":"${.:tree:sid:}",
"method":"jp1pfmSuggestionSetStatusOfEventsToProcessed",
"args":{
"eventSids":"${:plugin[3]::}"
}
},
"description":"Set the status of an alarm or agent event whose current status is normal to Processed."
}
}
]Example of suspending monitoring while a host is being maintained
The following shows an example of suspending monitoring of a host when two or more Performance Management health-check events indicating that the host has stopped were issued within the past one hour from the current time on the IM management node that corresponds to the monitoring host of Performance Management, or when three or more Performance Management alarm events having the Error severity level were issued within the past 30 minutes from the current time.
- Example of specifying the suggestion activation criteria and response actions
"suggestions":[
{
"suggestionId":"jp1_pfm_suspend_monitoring_for_performance_node",
"label":"Suspend the monitoring during the host maintenance.",
"node":"_CATEGORY_[^m].*_OBJECT_JP1PFM-A",
"permissions":[
["JP1_PFM_Admin"]
],
"cases":[
[
{
"type":"plugin",
"key":{
"sid":"${.:tree:sid:}",
"method":"jp1pfmSuggestionGetHostName",
"args":{}
},
"ope":"NOTIN",
"val":"",
"description":"Acquisition of the host name ended successfully."
},
{
"type":"plugin",
"key":{
"sid":"${../../..:tree:sid:}",
"method":"jp1pfmSuggestionExecManagerCmd",
"args":{
"commandName":"jpctool",
"commandArgs":"monitor list -host ${.:plugin[1]::}",
"lhostOption":true,
"successfulReturn":[0]
}
},
"ope":"REGEX",
"val":"\nH . Act",
"description":"The monitoring status of the selected host is not suspended."
},
{
"type":"eventCount",
"key":{
"sid":"${./<sameNode:tree:sid:}",
"statusFilter":[30],
"B.TIME":["${:time:-60.m.:}","${:time::}"],
"B.ID":["00004860"],
"REGEX_B.MESSAGE":"KAVL15022-E.*hcsstatus=Host Not Available",
"E.@JP1IM_DEALT":[0]
},
"ope":"GT",
"val":1,
"description":"Within the past hour 2 or more host stop events have been issued."
}
],
[
{
"type":"plugin",
"key":{
"sid":"${.:tree:sid:}",
"method":"jp1pfmSuggestionGetHostName",
"args":{}
},
"ope":"NOTIN",
"val":"",
"description":"Acquisition of the host name ended successfully."
},
{
"type":"plugin",
"key":{
"sid":"${../../..:tree:sid:}",
"method":"jp1pfmSuggestionExecManagerCmd",
"args":{
"commandName":"jpctool",
"commandArgs":"monitor list -host ${.:plugin[1]::}",
"lhostOption":true,
"successfulReturn":[0]
}
},
"ope":"REGEX",
"val":"\nH . Act",
"description":"The monitoring status of the selected host is not suspended."
},
{
"type":"eventCount",
"key":{
"sid":"${.:tree:sid:}",
"statusFilter":[30],
"B.TIME":["${:time:-30.m.:}","${:time::}"],
"B.ID":["00004840"],
"E.SEVERITY":["Error"],
"E.@JP1IM_DEALT":[0]
},
"ope":"GT",
"val":2,
"description":"Within the past 30 minutes 3 or more alarm events have been issued.(JP1 system event)"
}
],
[
{
"type":"plugin",
"key":{
"sid":"${.:tree:sid:}",
"method":"jp1pfmSuggestionGetHostName",
"args":{}
},
"ope":"NOTIN",
"val":"",
"description":"Acquisition of the host name ended successfully."
},
{
"type":"plugin",
"key":{
"sid":"${../../..:tree:sid:}",
"method":"jp1pfmSuggestionExecManagerCmd",
"args":{
"commandName":"jpctool",
"commandArgs":"monitor list -host ${.:plugin[1]::}",
"lhostOption":true,
"successfulReturn":[0]
}
},
"ope":"REGEX",
"val":"\nH . Act",
"description":"The monitoring status of the selected host is not suspended."
},
{
"type":"eventCount",
"key":{
"sid":"${.:tree:sid:}",
"statusFilter":[30],
"B.TIME":["${:time:-30.m.:}","${:time::}"],
"E.PRODUCT_NAME":["/PFM/ALARM_EVENT"],
"E.SEVERITY":["Error"],
"E.@JP1IM_DEALT":[0]
},
"ope":"GT",
"val":2,
"description":"Within the past 30 minutes 3 or more alarm events have been issued.(JP1 user event)"
}
]
],
"action":{
"type":"plugin",
"params":{
"sid":"${.:tree:sid:}",
"method":"jp1pfmSuggestionExecManagerCmd",
"args":{
"commandName":"jpctool",
"commandArgs":"monitor suspend -host ${.:plugin[1]::} -noquery",
"lhostOption":true,
"successfulReturn":[0,23]
}
},
"description":"Suspend the monitoring."
}
}
]