2 replies Latest Post - ‏2014-04-29T15:49:12Z by kftiv
15 Posts

Pinned topic Interaction between TBSM and Enrichment Services

‏2014-04-15T21:21:10Z |

Hello all,

I'm struggling on an issue where we enabled an Enrichment Service to add some information to events prior to the handling of the event by TBSM. However, when configuring "Event Enrichment", the events don't seem to be handled by the TBSM OMNIbus Event Reader anymore. The RAD_ServiceName is not filled in for the events, RAD_SeenByTBSM is still 0 and when checking the log, the events don't seem to be read by the TBSM OMNIbus Event Reader. 

It looks as if the Enrichment Service is changing the RAD attributes in such a way that the event no longer meets the selection criteria used by the TBSM OMNIbus Event Reader (a.o. RAD_

  • randybrown
    59 Posts

    Re: Interaction between TBSM and Enrichment Services

    ‏2014-04-22T19:05:58Z  in response to kftiv


    I didn't have any experience with event enrichment, so I decided to try it out in my development environment.

    I started with the tutorial found in the TBSM Service Configuration Guide at:

    I didn't do anything nearly as complicated as what was in the tutorial. I just wrote a policy to change the Node name on the event so it would match a TBSM service after being "enriched" -- basic proof of concept.

    Then I also had to set some properties as described in the Administrator's Guide at:

    These properties were needed to ensure my enrichment policy modified the event before TBSM tried to read it. They also ensure that the right field is set to allow TBSM to read the events after enrichment, so maybe one of these property settings is causing you a problem.

    Beyond that, the TBSM event reader uses the following default filter:

    (Class <> 12000) AND (Type <> 2) AND ((Severity <> RAD_RawInputLastValue) or (RAD_FunctionType = '')) AND (RAD_SeenByTBSM = 0)

    If you did not modify any of the highlighted fields, then I think the likely cause is one of the properties settings described in the Admin Guide that control the behavior of your Impact event reader.

    Hope that helps...


    Randy Brown

    • kftiv
      15 Posts

      Re: Interaction between TBSM and Enrichment Services

      ‏2014-04-29T15:49:12Z  in response to randybrown


      Thanks, for your reply. Actually I didn't realized it was posted. I saved it as draft and planned to update it later as you can see by the abrupt end.

      But I configured an Event Enrichment Service which  updates incoming events by adding some information. I configured the Event Enrichment by using the "Configure Event Enrichment" in the Service Configuration->Template tab which effectively changes the settings for the TBSM OMNIbus event reader by adding "impact.tbsmomnibuseventreader.objectserver.seenbyimpactselect=RAD_SeenByImpact \= 1" and a.o. adds the setting "impact.xxxenrichservice.objectserver.seenbyimpactupdate=RAD_SeenByImpact \= 1" to the enrichment service. These settings effectively put these services in a chain. The TBSM OMNIbus Event Reader will only process events which have been enriched by the Enrichment Service (which sets RAD_SeenByImpact to 1).

      However, I notice that some of the RAD fields are actually changed by the Enrichment Service in such a way that the events do no longer meet the criteria for the TBSM OMNIbus Event Reader as you mention in red. This effectively means that the Enrichment services enriches the event, but prevents the TBSM processing from taking place. I had expected that an Enrichment service would not touch any of the RAD fields (actually the RAD_FilterIDList has values which don't even match an existing filter).

      Hope this better clarifies the problem..