AIOps

by Carin Bentley

Event Destinations can be defined as a 'DEFAULT' event destination.  

This is how you would set an event desintation to be defined as a 'DEFAULT' event destination, using the default=Y parameter. 

tacmd createEventDest -i 123 -p host1=bigTECserver:4567 default=Y name=myTEC

And here is how that setting is used and referenced:

In the case where there is no event destination assigned in the Situation and EIF forwarding is enabled for the Situation, the events will be sent to all of the event destinations marked as 'Default=Y'. 

Generally, my experience is that this capability is rarely used in ITM and, personally, I recommend that ITM users assign their event destinations in the Situation definition to ensure EIF events are being sent where you want them to be sent. 

However, there is the capability to not set an event destination and let the Hub TEMS decide where the event should go, primarily to those Event Destinations marked 'DEFAULT:Y'

The issue is that it can be difficult to remove the event destination assignments from the Situation definition once they have been assigned. 

To view the information stored in the Situation definition, you run the following command:

tacmd viewsit -s

Open the exported file. 

The sitinfo field will look something like the following (you will find it down towards the bottom of the output):

TDST=0;]]>

In this example, the TDST parameter, which lists the event destinations, has just one event destination assigned and that is event destination '0' (ie zero).

It may also list multiple event destinations such as TDST=0,1.

Most customers with EIF forwarding enabled will see TDST=0 if they have not set up and assigned multiple event destinations in their environment. 

When the Situation is referencing no event destinations, the SitInfo field will contain no reference to TDST. 

The challenge comes when you want to remove the TDST setting from a Situation where a TDST has been configured. 

 - tacmd editsit gives you the capability to edit the SitInfo field but does not appear to provide a function to remove the TDST setting, if already set. 

 - unassigning all of the event destinations via the TEP Client GUI in the Situation Editor in the EIF tab does not remove the TDST setting from the sitinfo field.  Moving all event destinations from assigned to available and saving the Situation does not remove the TDST parameter from the Situation definition stored in ITM but leaves event destination '0' (zero) assigned. 

So here is a method that can be used to remove the TDST value, which involves exporting the Situation to a file, changing the sitinfo field in the exported file and re-importing the Situation.

C:\ODI>tacmd viewsit -s test_tec1
Name                   : test_tec1
Full Name              :
Description            :
Type                   : Windows OS
Formula                : *IF *VALUE NT_Cache.Copy_Read_Hits_% *EQ 1
Sampling Interval      : 0/0:15:0
Run At Start Up        : Yes
Distribution           :
Text                   :
Action Location        : Agent
Action Selection       : System Command
System Command         : *NONE
True For Multiple Items: Action on First Item only
TEC Severity           : Critical
TEC Forwarding         : Y
TEC Destination        :

tacmd deletesit -s 

tacmd createsit -i c:\test_tec1.xml