Rules file

The rules file scom2012.rules defines how the probe processes event data to create meaningful Netcool/OMNIbus alerts.

The probe takes an event stream and parses it into elements. It then processes the event elements based on the logic in the rules file. It assigns the elements to ObjectServer fields and forwards them to the ObjectServer, where they are inserted as alerts into the alerts.status table.

The elements parsed by the probe are listed in Elements. For more information about using rules files, see the IBM Tivoli Netcool/OMNIbus Probe and Gateway Guide (SC14-7608).

Severity level mappings

Netcool/OMNIbus uses different terms than Microsoft SCOM 2012 to describe the severity level of an alert. The following table shows how the probe maps Microsoft SCOM 2012 severity levels to the Netcool/OMNIbus severity levels used by the ObjectServer.

Table 1. Severity level mappings
Microsoft SCOM 2012 severity level	Netcool/OMNIbus severity level
Information	Clear
Warning	Warning
Error with severity Low	Minor
Error with severity Normal	Major
Error with severity High	Critical

NodeAlias event field

To enable ObjectServer automations to connect to the probe's command port, the NodeAlias field of each event stores the TCP address of the probe in the following format:

host_name:command_port_number

Where host_name is the name of the probe's host machine and command_port_number is the value of the CommandPort property.

Note: If you change the value of the CommandPort property, existing events in the ObjectServer will still contain the old port number in their NodeAlias fields. This might cause the failure of any automation that uses the value of the NodeAlias field. In this case, you must use the Microsoft SCOM 2012 Operations Console to manually re-send the existing events, thereby updating them in the ObjectServer with the new NodeAlias field value.