Every Netcool/OMNIbus deployment will have custom fields added to hold additional custom alert information. But how do I get that information into AIOps? This blog will take you through the simple steps to map your custom Netcool/OMNIbus fields to AIOps and then use them in your Alerts viewer and policy conditions.
First, add a "details" section to your Netcool/OMNIbus Connector mapping. Each of your custom fields should be mapped to AIOps via the details attribute.
In the following example mapping, I have added a "details" attribute (just below the "expirySeconds" attribute) and added my two custom fields "appId" (@AppID) and "region" (@Region) as sub-attributes of it.
(
$isIPAddr := function($i){ $contains($i,/^[0-9]+.[0-9]+.[0-9]+.[0-9]+$/)};
{
"summary": alert.@Summary,
"deduplicationKey": alert.@Identifier,
"sender": {
"service": alert.@Agent,
"name": alert.@Manager
},
"resource": {
"name": alert.@Node = "" ? alert.@NodeAlias = "" ? undefined : alert.@NodeAlias : alert.@Node,
"location": alert.@Location = "" ? undefined : alert.@Location,
"ipAddress": $isIPAddr(alert.@NodeAlias) ? alert.@NodeAlias : $isIPAddr(alert.@Node) ? alert.@Node : undefined,
"hostname": $not($isIPAddr(alert.@Node)) ? alert.@Node : undefined,
"sourceId": alert.@BSM_Identity = "" ? undefined : alert.@BSM_Identity,
"service": alert.@Service = "" ? undefined : alert.@Service,
"port": alert.@PhysicalPort = 0 ? undefined : alert.@PhysicalPort,
"physicalslot": alert.@PhysicalSlot = 0 ? undefined : alert.@PhysicalSlot,
"physicalcard": alert.@PhysicalCard = "" ? undefined : alert.@PhysicalCard,
"scopeId": alert.@ScopeID = "" ? undefined : alert.@ScopeID
},
"type": {
"eventType": alert.@Type = 1 ? "problem" : alert.@Type = 2 ? "resolution" : alert.@Type = 13 ? "information" : "problem",
"classification": alert.@EventId = "" ? alert.@AlertGroup: alert.@EventId
},
"eventCount": alert.@Tally,
"signature": alert.@Identifier,
"firstOccurrenceTime": alert.@FirstOccurrence,
"lastOccurrenceTime": alert.@LastOccurrence,
"severity": alert.@Severity <=0 ? undefined : alert.@Severity = 1 ? 1 : alert.@Severity < 6 ? alert.@Severity + 1 : alert.@Severity >= 6 ? 6,
"state": alert.@Severity = 0 ? "clear" : "open",
"acknowledged": alert.@Acknowledged = 1 ? true : false,
"expirySeconds": alert.@ExpireTime,
"details": {
"appId": alert.@AppID = "" ? undefined : alert.@AppID,
"region": alert.@Region = "" ? undefined : alert.@Region
},
"insights": [
{
"details": {
"lastProcessedEventOccurrenceTime": alert.@LastOccurrence
},
"id": "event-occurrence",
"type": "aiops.ibm.com/insight-type/deduplication-details"
}
]
}
)
NOTE: Take care to observe the correct case usage convention for the field names. It won't stop it functioning, but does look more professional if it's correct.
After the changes have been made to the mapping, click the "Save" button to save your changes. The Netcool Connector pod will then restart, and the new fields will be visible in any new new events. Any existing events won't reflect the changes; the changes will only be visible in new events passing through the Connector.
In the Alerts viewer, you will be able to double-click an event and see your added attributes in: Alert details > Information > Raw:
You can also edit your view and add your custom attributes to your views. To do this, click on the "View configuration" button, then select "Manage selected view".
Type in the name of the field in the "Search and select a column" box and check the ones you want to add:
Next, drag the field so it is in the correct order in the view. Finally, set the column heading, justification, and size in the "Configure selected columns" box:
You can also refer to your custom fields when creating AIOps policy conditions. The following screen shot shows an example:
NOTE: You need to type in the custom attribute name into the box, per the above example.
Now you should be able to map any and all of your custom fields from Netcool/OMNIbus into AIOps and use them as needed.
NOTE: At the time of writing, you cannot select any details sub-attributes as scopes for scope-based grouping policies in AIOps. If this is needed, map these custom fields as sub-attributes of "resource" instead. You will then be able to choose these for your scopes. An alternative is to set @ScopeID in Netcool/OMNIbus, then it will automatically group when it is mapped to "scopeId", per the sample mapping provided above.