Event rules REST API

Event rule fields

• message_key
• search
• component

• All event rules with a message_key field that matches the msg_key field in the event.
• All event rules with a search field that matches the msg_text field in the event.
• All event rules with a component field that matches the event type field.

Event rule types

NOTHIDDEN = 0

Use this rule to specify that an event is not hidden. This behavior is the default one if no rule is found. If an event matches both a hidden and not hidden rule, hidden takes priority.

HIDDEN = 1

Use this rule to hide an event. If an event matches both a hidden and not hidden rule, hidden takes priority. The following example shows a hidden rule:

{
      "message_key": "CWZIP2221I",
      "type": 1
   }

DISCARD = 2

Use this rule to discard the matching event, that is, the event is not written to the database. The following example shows a discard rule:

{
      "message_key": "CWZIP2221I",
      "type": 2
   }

SEVERITY = 4

Use this rule to modify the severity of a matching event. The following example shows a severity rule:

{
      "message_key": "CWZIP2221I",
      "type": 4,
      "severity": "Critical"
   }

You can use one of the following values to specify the severity:

• "Critical"
• "Warning"
• "Informational"

Note: If multiple event rules match an event, the severity rule with the highest priority is applied to the event.

CATEGORY = 8

Use this rule to modify the category of a matching event. The following example shows a category rule:

{
      "message_key": "CWZIP2221I",
      "type": 8,
      "category": "CallSupport"
   }

You can use one of the following values to specify the category:

• "CallHome"
• "CallSupport"
• "CustomerServiceable"
• "Resolution"
• "Alert"

Note: CallHome is the highest priority and Alert is the lowest priority. If multiple event rules match an event, the category rule with the highest priority is applied to the event.

CALLHOME_DISABLE = 16

Use this rule to disable call home for matching events. The following example shows a CALLHOME_DISABLE rule:

{
      "message_key": "CWZIP2221I",
      "type": 16
   }

EXECUTE = 32

This rule is intended for internal use only.

RESOLVES = 64

Use this rule to define a specific event that resolves a previous event. The following example shows a RESOLVES rule:

{
      "message_key": "CWZIP2221I",
      "type": 64,
      "resolves" : "CWZIP3333E"
   }

All fields in the resolving event and the event to be resolved must match, except for the following fields:

• msg_key
• msg_text
• severity_value
• category

Get all event rules

Returns all event rules.

Response body

[
{
"created_time_raw": 1392910278187,
"isas_rn": 1,
"severity": null,
"type": 1,
"updated_time": "Thu 20 Feb 2014 15:31:18.187 UTC",
"message_key": "CWZIP8888I",
"version": "1.2.0.0",
"id": "/admin/resources/event_rules/d5445480-2c6f-4162-8978-28a6e41d3312",
"category": null,
"updated_time_raw": 1392910278187,
"search": null,
"component": null,
"description": null,
"callback": null,
"resolves": null,
"maintenance": "F",
"created_time": "Thu 20 Feb 2014 15:31:18.187 UTC"
},
{
"created_time_raw": 1392910278242,
"isas_rn": 2,
"severity": null,
"type": 8,
"updated_time": "Thu 20 Feb 2014 15:31:18.242 UTC",
"message_key": "CWZIP8888I",
"version": "1.2.0.0",
"id": "/admin/resources/event_rules/471e9d17-48c3-413a-bf6e-5da4d466a5cd",
"category": "Alert",
"updated_time_raw": 1392910278242,
"search": null,
"component": null,
"description": null,
"callback": null,
"resolves": null,
"maintenance" : "F",
"created_time": "Thu 20 Feb 2014 15:31:18.242 UTC"
}
]

created_time_raw

The time, in raw format, at which the event rule is created.

severity

The severity of the event rule. For more information, see Event rule types.

type

The type of the event rule. For more information, see Event rule types.

updated_time

The time at which the event rule is last updated.

message_key

The message key to match. For more information, see Event rule fields.

version

The version key for retrieving the label for the event type.

id

The ID of the event rule.

category

The category of the event rule. For more information, see Event rule types.

updated_time_raw

The time, in raw format, at which the event rule is last updated.

search

The search to use. When creating an event rule, you must specify one of the following fields: search, message_key, or component. For more information, see Event rule fields.

component

The component to match to. For more information, see Event rule fields.

description

The description of the event rule.

callback

This field is internal.

resolves

The message key of the event to resolve. This field is applicable only to event rules of type RESOLVES. For more information, see Event rule types.

maintenance

This field can take one of the following values:

• 'T': If set to true, the system verifies if the component related to the event is in maintenance mode. If so, the rule is applied.
• 'F': If set to false, the event rule has a type other than maintenance.

Note: Maintenance rules have the highest priority. For example, if the severity of a maintenance rule is Informational, it is of higher priority than a rule with a severity of Critical.

created_time

The time at which the event rule is created.

Create event rule

Creates an event rule.

Get a specific event rule

Returns a single event rule that is identified by {id}.

Update a specific event rule

Modifies a single event rule that is identified by {id}.