Create a trigger

Before you begin

You can create a new trigger if you are an RBA Author or RBA Approver. For more information about roles, see Creating users.

You must create an Event Trigger connection before you can work with triggers. For more information, see Event Trigger (Netcool/Impact).

About this task

As a best practice, define the conditions so they don't overlap with the conditions that are already defined within other triggers. In most cases, it's best to create trigger conditions that are all based on a single event attribute or a small common set of event attributes. Also, use the equals operator to describe the exact match that you are looking for.

If the conditions from multiple triggers match to a single Netcool/OMNIbus event, then these triggers are sorted by their priorities. You can manage the trigger priority from within the Runbook Automation trigger editor. The range of supported values is in the range 1 - 1000, 1 being the lowest priority and 1000 the highest. Think of it as a weight applied to the filter. If two triggers have the same priority assigned to them, then their ordering is undefined. In most cases, the trigger that was defined first takes effect, but you cannot rely on this rule. The order might change when triggers are deleted, and trigger IDs are reused.

The runbook IDs from the sorted triggers are stored in that order in the field RunbookIDArray in the Netcool/OMNIbus event (in JSON format). If the trigger at the first position links to a fully automated runbook and is enabled, then Netcool/Impact invokes this fully automated runbook. Netcool/Impact does not invoke the fully automated runbooks of all the other triggers from the sorted list.

In any case, Netcool/Impact stores the runbook parameters within the Netcool/OMNIbus event according to the parameter mapping that is defined in the trigger at the first position.

Example: You create "trigger-1" that links events that match "filter-1" to the manual runbook with "runbookID-1". Later, you realize that it would be preferable for those events to be handled by a fully automated runbook with "runbookID-2". And the manual runbook with "runbookID-1" should be linked only to the event as a backup, in case the fully automated runbook fails.

To achieve this, create a new trigger "trigger-2" with a set of conditions "filter-2" and link it to "runbookID-2". The "filter-2" must be (slightly) different from "filter-1", in a way that it still matches the wanted events. Then, set the priority for "trigger-2" to a non-default value. For example, set it to 567. For any new event that matches both "filter-1" and "filter-2", the fully automated runbook with "runbookID-2" is executed. The "RunbookIDArray" will have the content ["runbookID-2","runbookID-1"].

Create a custom Netcool/OMNIbus launch-in-context tool that picks the second entry from the RunbookIDArray and invokes the manual runbook.

If the set of runbook parameters for the manual runbook is a subset of the runbook parameters for the fully automated runbook, all runbook parameters are automatically set when you start the manual runbook.

Procedure

Click Triggers > Create new trigger.
Enter the Name and Description of the Trigger. Name is a required field. In the description field, describe what kind of events this trigger is used for. What problem reported by an event does the mapped runbook solve?

Warning: The description must not contain newline characters.
Add one or more conditions to trigger events. The conditions describe the events that the trigger will act on.
1. Enter a Name for the condition.
2. Select an Attribute and Operator from the drop-down lists. Depending on the attribute selected, you either enter a Value or select one from the drop-down list. For example, you enter a value for a Summary attribute and you select a value for a Severity attribute.
  Generally, it is recommended to use the equals operator whenever possible. If you need more flexibility, you can use the like operator on an attribute that supports strings as values. The following tips give some ideas for writing value patterns with the like operator:
  - If you specify only a string pattern, then all strings that contain the string pattern will match. For example, if you define the value pattern Status, then TriggerStatus, MyStatusLogger, Status, and StatusLogger match, but MemStat does not match.
  - Value patterns are case-sensitive.
  - You can use [abcd] or [a-d] to match any (single) character in the brackets or in the defined range of characters.
  - You can use the regular expression quantifiers *, +, ?, for example: [a-d]* or .+.
  For a full description of the value patterns that can be entered in the value field, see the NETCOOL regular expression library in the Netcool/OMNIbus documentation.
Tip: When selecting specifying conditions, you can join multiple conditions by using the AND and OR operators. For example, if you select AND the mapping is processed as follows: Event1 is mapped with condition1 AND condition 2 AND condition 3. If you select OR, the mapping is processed as: Event 1 is mapped with condition 1 OR condition 2 OR condition 3.
Optional: When selecting specifying conditions, you can check to see how many events would match the conditions that you set. Go to the end of the Trigger conditions section, and click Run a new test. The result shows how many events would have matched the trigger conditions.
Click Show results to view a list of all the events that would have matched the conditions. Click Run a new test to change the timeframe for testing, or if you changed conditions and want to check again for matching events.
Assign a runbook that runs when the trigger is active.

In the runbook table, click Type and select if you want to list automatic or manual runbooks. The difference is that automatic runbooks do not require any manual interaction from the operator. If the event occurs, the runbook runs automatically. For manual runbooks, the runbook is added to the event so that the operator can launch to the runbook from the event viewer. You can also start typing the name of the runbook that you are looking for. As you type, the list displays only runbooks that contain the typed text. Select a runbook from the table and click Select this runbook.
The parameters of the selected runbook are displayed. Select how you want to enter the parameter value:
Ask user
Draft comment: BRYANHOBBERT
CONFIRM THIS:

The user can enter a pattern to extract a subset of the parameter value by entering a regular expression.

From event

The parameter value is contained in the event. If the runbook is started, the parameter value is used from the event.

Manual

If the runbook is started, the operator manually enters the parameter values.
The regular expression syntax for the Ask user option is based on the Perl regular expression syntax. The syntax is the same as that used in Netcool/Impact. The following conditions apply:
- If the pattern field is empty, then the complete value of the selected event property is copied into the runbook parameter.
- If the pattern field contains a regular expression, the RExtract tool with the default behavior for the Flag parameter is used (true). For more information about that tool, see the Netcool/Impact product documentation RExtract.
- Tips for writing regular expressions:
  - Always use groups. For example, specify (\w{4}) instead of \w{4}.
  - Specify the regular expression itself without adding any modifiers. The global modifier gets applied automatically by RExtract. For example, specify (\w{4}) instead of /(\w{4})/g.
  - The regular expression (.*) matches no result data, which is the default behavior of RExtract.
  - If there are multiple matches, the last match is returned. For example:
    Value: omnibus.service.netcool Pattern: ([a-z]{5}) Result: netco
    Note: In theory, there are three matches: {omnib, servi, netco}.
  - If there are multiple concatenated groups, then the first group of the last match is returned. For example:
    Value: omnibus.service.netcool Pattern: ([\w]{4})([a-z]) Result: netc
    Note: In theory, there are three matches: {omnib, servi, netco}. The last match is netco, which is divided into the two groups netc and o.
  - If you copy a regular expression from a document, ensure that all characters are copied as plain letters. For example, use the circumflex accent ^ (U005E) instead of the modifier letter circumflex accent ˆ (U02C6).
  - The pattern can contain escaped backslash characters (\\).
Note: If you change the corresponding runbook and, for example add or remove a parameter, the parameter mapping will no longer work. Ensure that you edit the trigger again and update the parameter mapping.
Select Enable if you want this trigger to be used. Then, the trigger is added to the Triggers table with the flag Enabled. If you do not want to use this trigger, toggle the Enable button to off. The trigger is added with the flag Disabled.
If you added one or more event sources in addition to the default event source RBA_ObjectServer, then the trigger editor includes the additional section Trigger event sources. Select the appropriate set of event sources that this trigger should act on:
- If this trigger should act on the events of a particular subset of the existing event sources (assuming the event conditions match), then enable the switch Restrict the trigger to a specific set of event sources and select each of the applicable event sources. This is the expected selection for most triggers.
- If this trigger should act on the events of all existing and all potential future event sources (assuming the event conditions match), then disable the switch Restrict the trigger to a specific set of event sources.
Click Save.