Configuring Metrics Rules in Structured Log File Policies

Rules define the action a policy should take in response to a specific type of incoming metric. Each rule consists of the following:

• A condition for the incoming data

  The condition is the part of a policy that describes the data source.

• Settings for the outgoing event

  The settings define the actual metric data that Operations Connector sends to OMi.

A policy must contain at least one rule. If the policy contains multiple rules, they are evaluated consecutively. After the condition is matched in one rule, rule evaluation stops.

For examples and end-to-end workflow information on collecting metrics data, see Collecting Metrics Data topic.

To access

In the Operations Connector user interface, click in the toolbar. Then click Metrics > Structured Log File.

Alternatively, double-click an existing policy to edit it.

Click Rules to open the policy Rules page.

Rule types

The rule types are:

• Store on matched rule. If matched, Operations Connector stores metrics in a buffer until a maximum number of records or a maximum amount of time is reached. These metrics are sent to OMi when they are requested, and they use the settings defined for the rule. If you do not configure these settings, the default settings are used.

• Suppress on matched rule. If matched, Operations Connector stops processing.

• Suppress on unmatched rule. If not matched, Operations Connector stops processing.

Metric attributes

Each time a metric policy runs, it extracts raw data from its defined data source and builds a metric structure.

A metric structure consists of these attributes:

• Basic attributes:

  • Data domain

    The namespace of the integrated performance records, used in the Operations Agent store to avoid clashes.

  • Metric class

    Defines the metric class under which the metric appears in the Operations Agent store and consumers.

  • Metric name

    Defines the metric name under which the metric appears in the Operations Agent store and consumers.

  • Related CI

    Used to identify an instance of a performance record and associates it with a concrete CI instance. For details on how to associate the Related CI with the values in the RTSM model, see Create a policy topic. For an example, see Example – Create a Metrics Policy topic.

  • Node

    Used to identify a node-like CI to which the performance records are associated to.

  • Value

    The actual performance value which is converted to 64-bit floating point number.

  • Time measured

    The time stamp when the value was determined in the third-party system.

• Advanced attributes:

  • Original metric name

    The name of the metric as used on the third-party system.

  • Unit

    The unit of the metric.

  • Integration id

    An id, used to identify the source of the integration.

Tasks

How to configure rules for metrics in log file policies

1. In the Policy Rules section, click and select the type of rule to define what the policy should do in response to a specific pattern matching field. Each policy must have at least one rule.

2. In the Rule Content section, use the Condition tab to specify the pattern matching fields and values that the policy searches for in the structured log file that the policy reads. If the policy finds a match, it may or may not generate an event, depending on the rule type.

   1. Click to create a new condition. New conditions by default use the equals operator.

   2. Click to expand the new condition.

   3. In the Property field, specify the pattern matching field that the policy searches for (for example, host).

      If you are working with sample data, you can drag and drop the pattern matching field from the Input Data Properties list to the Properties field.

   4. Select the pattern operator.

      If you select the matches operator, you can type a pattern in the Operand field.

   5. In the Operand field, type the value or pattern that you want the policy to compare with the pattern matching field. If you are working with sample data, you can drag the value from the Values list and drop it in the Operand field.

3. Optional. If you are creating a rule of the type 'store on matched rule', set the attributes (Basic or/and Advanced) for metrics that you want the rule to override. If default attributes are specified in the Defaults tab, you use the defaults or you can override them as described below.

4. Optional. Use the Sample Data tab to drag the input data references to the attribute boxes. Alternatively, you can type the reference directly into the attribute box.

   Input data references use the following syntax: <$DATA:<InputReferenceField>>.

   Field names originate from the structured log file pattern settings defined for the data source.

   Operations Connector replaces the pattern matching field at runtime with the value of the specified field. If you insert a field value, the value will be used.

   The Sample Data tab is empty if no sample data has been loaded into the policy or if the sample data does not match the structured log file pattern specified in the source page.

5. Optional. Use the Mappings tab to add mapping definitions to the attribute boxes.

   Mappings are custom variables that you define in the Mappings page.

   Alternatively, type the custom variable into the attribute box using the following syntax:

   <$MAP(<CustomVariable>)> where <CustomVariable> is the map name of the variable (for example, <$MAP(maphost)>).

   If the custom variable does not have a input data reference assigned, use the following syntax:

   <$MAP(<CustomVariable>,<SourceValue>) where <SourceValue> can be one of the following:

   • Name of the input data reference, for example <$MAP(maphost)>,<$DATA:host>

   • The source value itself, for example <$MAP(maphost,Critical)>

6. Optional. Use the Pattern Matching Variables tab to add variables created with pattern matching.

   Pattern matching variables insert matched strings that have previously been assigned to variables. To insert a pattern matching variable, type the variable name enclosed in angle brackets (for example, <VariableName>) or drag and drop it from the Pattern Matching Variables list to the metric attribute.

7. Optional. Use the Operators tab to apply operators to the attribute values. Two functions are available:

   $MATCH(), to test a string or a variable against a pattern. The $MATCH function accepts three or four parameters:

   - the input string

   - the pattern definition

   - the output string if pattern matches on the input string

   - the output string if the pattern does not match (optional)

   Example: The data of the input field hostname start always with "TEST" (for example "TESTABC"). The $MATCH function to use the string after "TEST" is as follows:

   $MATCH(<$DATA:hostname>,TEST<*.prefix>,<prefix>)

   • <$DATETIME(FORMAT,VALUE)>, to convert the format of dates from the common format to the UNIX systems time (Epoch time) format.

     To apply operators to the attribute values, you can drag and drop them to a text field in the left pane of the same policy editor page. The appropriate tooltips are shown while performing this operation, which describe the role of the dragged operator.

8. Optional. Use the Indicators tab to add indicators to the source or target value fields. After loading the indicators from the connected OMi server, the Indicators tab shows a hierarchy of configuration item types.

9. Optional. In the Policy Variables tab, add policy variables to metric attributes. Operations Connector replaces the variables with the appropriate values in the generated metric.

   Use quotation marks to surround variables, for example "<$MSG_NODE>" or "<$MSG_GEN_NODE>", at least for those variables whose values can contain space characters.

Related tasks

• How to Collect Metrics Data from Structured Log Files

UI Descriptions

Related topics

Configuring Data Source in Structured Log File Policies

Configuring Mappings in Structured Log File Policies (Event and Metrics Only)