CEAProcessType

The diagram highlights the types of logic that take place in relation to event processing.

• IBM® Tivoli® Netcool®/OMNIbus triggers use conditional logic to set the CEAProcessType value for an event based on conditions. Conditions such as whether the change is an insert, reinsert, or update or depending on which field is changing.
• Gateway rules can filter out events with particular CEAProcessType values. By default, no filter is applied on CEAProcessType values.
• Any messages that are filtered through the gateway are listened to.
• These components listen to all inserts, reinserts, and updates.
• These components listen for event changes such as: long-standing unclears, updates to important columns (such as ScopeID changes), and first-time inserts, because all these types of changes are relevant for event correlation. When a cleared event is clear for a long time and its severity increases, this change is considered a long-standing unclear. The UnclearQuietPeriodSeconds property defines what is considered to be a long time.
• The cloud native event analytics (CNEA) Datalayer pod receives events through IDUC from Netcool/OMNIbus and writes them to the noi-events topic in Kafka. The inference service does not process these events. The alert trigger service and the alert action service process these events.

An event's CEAProcessType field controls the actions of the CNEA pods. Actions, along with the action of doing nothing, are grouped as follows.

• Perform event correlation, and enrichment. Persist the event data to Cassandra. Ticket creation can occur.
• Don’t perform event correlation but do perform enrichment. Don’t persist the event data to Cassandra. No ticket modification occurs.
• Don’t perform event correlation but do perform enrichment. Persist the event data to Cassandra. No ticket modification occurs.
• Perform event correlation, enrichment, and ticket membership modification. Persist the event data to Cassandra. Ticket modification can occur.

If an action is required, the Netcool/OMNIbus triggers set the CEAProcessType value. The value of the CEAProcessType column of an event tells the CNEA pods what action to take.

• 0: The default value for CEAProcessType is 0, which the CNEA pods interpret as no action required (do nothing). No event correlation or enrichment occurs and the event is not persisted to the Cassandra database.
• 10: Setting the CEAProcessType value of an event to 10 tells the CNEA pods to perform event correlation and enrichment and also to persist the event data to Cassandra. The value 10 is used if the event was a fresh new insert.
• 20: Setting the CEAProcessType value of an event to 20 tells the CNEA pods to perform event enrichment. However, event correlation is not performed and the event data is not persisted to Cassandra. The value 20 is used if the change was a reinsert, which doesn’t affect ScopeID or severity. Also, if a reinsert unclears an event after a long time that is considered a special case, see value 50.
• 30: Setting the CEAProcessType value of an event to 30 tells the CNEA pods to perform event enrichment and persist the event data to Cassandra. However, event correlation is not performed. The value 30 is used for updates to fields other than ScopeID. Any changes to severity (including from a reinsert) use 30. However, if an event is uncleared by an update after a long time that is considered a special case, see value 50.
• 40: Setting the CEAProcessType value of an event to 40 tells the CNEA pods to perform event correlation, enrichment, and ticket membership modification. Also, the event data is persisted to Cassandra and ticket modification can occur. The value 40 is used if the change was made to the ScopeID field by an update or reinsert. However, if an event is uncleared by an update after a long time that is considered a special case, see value 50.
• 50: Setting the CEAProcessType value of an event to 50 tells the CNEA pods to perform event correlation, enrichment, and ticket membership modification. Also, the event data is persisted to Cassandra and ticket modification can occur. The value 50 is used for long-standing, unclear reinserts or updates. For example, if the reinsert or update changes the severity from 0 to nonzero after a long time. The UnclearQuietPeriodSeconds property defines what is considered to be a long time.

When setting the CEAProcessType field, triggers use five properties in the master.cea_properties table.

The following table details the action taken by the CNEA pods, depending on the value of the CEAProcessType field.

More granular customization of CNEA actions is possible by providing alternative triggers to set the CEAProcessType field. You can customize the default logic values by disabling the CNEA triggers and creating new triggers with custom logic. Disable the following triggers.

• The cea_process_type_set_on_insert trigger fires for all inserts.
• The cea_process_type_set_on_reinsert trigger fires for all reinserts.
• The cea_process_type_set_on_update trigger fires for all updates.

• Customized unclear logic: The default triggers assume that events moving from a clear to unclear severity after a period of time are valid for correlation.
• Customized custom scope field: If a custom scope field exists in Netcool/OMNIbus, for example CEAImpactREGroupScopeId or CEAImpactPatternScopeId for linking on-premises Event Analytics, then provide a custom version of the cea_process_type_set_on_update trigger. If the custom scope fields change, this custom trigger sets CEAProcessType to the value of the CEAProcessingFullBroadcastUpdateValue property.

CREATE OR REPLACE TRIGGER cea_process_type_set_on_update_custom
GROUP cea_process_type
PRIORITY 2
COMMENT 'Set process type to one for an update'
BEFORE UPDATE ON alerts.status
FOR EACH ROW
WHEN get_prop_value('ActingPrimary') %= 'TRUE'
DECLARE
		DefaultValue        INTEGER;
		InfoOnly            INTEGER;
		FullBroadcast       INTEGER;
		outtype             INTEGER;
begin
SET InfoOnly = 30;
SET FullBroadcast = 40;


		-- LOAD UP VARIABLES BASED ON PROPERTIES
		for each row property in master.cea_properties where property.Name in ( 
			'CEAProcessingInfoOnlyUpdateValue', 'CEAProcessingFullBroadcastUpdateValue'
		)
		begin
			if (property.Name = 'CEAProcessingFullBroadcastUnclearValue') then
				SET InfoOnly = property.IntValue;
			end if;

			if (property.Name = 'CEAProcessingFullBroadcastUpdateValue') then
				SET FullBroadcast = property.IntValue;
			end if;
		end;

		SET DefaultValue = InfoOnly;

		--- HANDLE CUSTOM SCOPE CHANGES - do all actions
		if (old.CEAImpactPatternScopeId != new.CEAImpactPatternScopeId) then
			set DefaultValue = FullBroadcast;
		end if;
		if (old.CEAImpactREGroupScopeId != new.CEAImpactREGroupScopeId ) then
			set DefaultValue = FullBroadcast;
		end if;

		EXECUTE cea_handle_process_type_changes(new, old, DefaultValue, outtype);
		set new.CEAProcessType = outtype;
end;
go