Situation examples

Review the situation definition examples to better understand the different types of situations you can create.

Display item examples

Some multiple-row attribute groups have attributes that can be designated as display items in situations. When you add a display item to the situation, it behaves a little differently. Like any other situation, it opens an event when its condition is true. But unlike other situations, it can become true again for another row in the data sampling if the condition is true.

Processes situation

To illustrate, consider a situation that looks for any Windows process that is consuming over 5% of processor time and with Process Name designated as the display item.

As it is displayed in the Formula tab of the Situation editor:

	% Processor Time
1	> %5

and in Show Formula

(% Processor Time > 5) Display Item:NT_Process.Process_Name

After starting the situation on MYSYSTEM, we learn that three processes are consuming more than 5%. The situation becomes true for BIG, BIGGER, and BIGGEST, and three events are opened. If this situation had no display item, it would have become true for BIG, but never would have found BIGGER or BIGGEST until the first process went below 6% and the event closed.

If you were to look at the events in the message log view, they would look like this:

Status	Situation Name	Display Item	Origin Node	Global Timestamp
Opened	Process Time GT 5 percent	Biggest	Primary:SYSTEM:NT	12/15/09 11:10:05
Opened	Process Time GT 5 percent	Bigger	Primary:SYSTEM:NT	12/15/09 11:09:27
Opened	Process Time GT 5 percent	Big	Primary:SYSTEM:NT	12/15/09 11:09:05

Event log situation

In this example, the log space low situation checks the Windows logs for any that are over 95% capacity, and has the event log name as its display item.

	% Usage
1	>= 95

and in Show Formula:

(% Usage >= 95) Display Item:NT_Monitored_Logs_Report.Log_Name

After starting the situation on MYSYSTEM, we learn that two log files are almost full, Application and System, so two events are opened. If this situation had no display item, it would have become true for System, but never would have found Application until the System log file size had been reduced to less than 95% capacity.

If you were to look at the events in the message log view, they would look like this:

Status	Situation Name	Display Item	Origin Node	Global Timestamp
Opened	NT Log Space Low	Application	Primary:SYSTEM:NT	12/15/09 11:10:05
Opened	NT Log Space Low	System	Primary:SYSTEM:NT	12/15/09 11:09:27

Embedded situation examples

Conditions that can be combined in many different situation scenarios make useful embedded situations. The following situation can be embedded in any situation that you do not want to run on Sundays when the computer is being serviced.

Not_Sunday situation:

	Day of Week
1	>'Sunday'

NT_Services_AutoStart_NoSunday

	Start Type	Current State	Not_Sunday
1	=='Automatic'	== 'Stopped'	== True

The Not_Sunday situation is distributed to, but not associated with the managed system so you do not see an event indicator in the Navigator when it becomes true, which would otherwise happen every day except Sunday. The sampling interval for this situation was set to 1 day. This enables the situations in which it is embedded, like NT_Services_AutoStart_NoSunday, to continue running but not cause alerts on Sunday when the computer is unavailable.

Correlated situation examples

Suppose you have a Disk_Usage_Warning situation that has been distributed to 100 managed systems. You create a correlated situation that alerts you when Disk Space Warning is true on the most critical managed systems.

	Disk_Usage_Warning @Primary:MAIN1:NT	Disk_Usage_Warning @Primary:MAIN2:NT	Disk_Usage_Warning @Primary:MAIN3:NT
1	== True	== True	== True

This correlated situation can be edited so that it becomes true when the Disk_Usage_Warning situation opens an event on any two of these three managed systems:

	Disk_Usage_Warning @Primary:MAIN1:NT	Disk_Usage_Warning @Primary:MAIN2:NT	Disk_Usage_Warning @Primary:MAIN3:NT
1	== True	== True	== True
2	== True		== True
3		== True	== True

Expert advice HTML examples

node=$EVENT:ATTRIBUTE.ISITSTSH.NODE$;

"BODY
BGCOLOR='#FFF80'><div align=center><h3><i>Advice on situation </i></h3><h2>"+name+"</h1><p><img
src=http://localhost:1920///cnp/kdh/lib/wws_globe.gif> The number
of concurrent connections associated with the Tracker server on <b>"+node+"</b>
is high.<p> Click here for more information: <a href=http://localhost:1920///cnp/kdh/lib/classes/candle/fw/resources/help/wkspace_overview.htm>Operations
Runbook</a></div>"