How to set up a two-step Smarts SAM escalation policy, where a tool is run when the notification is created and a second tool is run when the notification is cleared.
To set up a two-step Smarts SAM Escalation Policy, do the following:
-
Create an Escalation Policy filtering on required attributes.
-
Create level 0, which lasts for the time notifications should be smoothed.
-
In level 1, create a tool which executes a required action and sets a User Defined field. The User Defined field is necessary for the second policy, which subscribes to inactive notifications.
-
Create a second Escalation Policy. The second policy will only process clears for notification that were acted upon by the first policy. This policy will filter on the same attributes as the first one, but will also filter on "Event State = INACTIVE" and on the User Defined field modified by the first policy.
-
Create a tool for level 0 for the second policy to write the required attributes of notification to the same log file as the first policy.