Edit system Threshold Violation Event Severity in Performance Management

Products

• CA Infrastructure Management
• CA Performance Management - Usage and Administration
• DX NetOps

Issue/Introduction

How to change Severity for system default Threshold Violation Events in Performance Management.

Performance Management Events seen in Spectrum trigger unwanted user Notifications due to their Severity. How can we keep the Events but change Severity to limit their inclusion in Notification Rules?

How to change Major to Minor Severity for Performance Management default system Events?

Environment

All supported Performance Management releases

Cause

There are default system Events based on Threshold Violations raised in Performance Management. These are out of the box Events that are raised without user configuration.

Resolution

To change system Threshold Violation Event Severity we use a REST API. In this example we're going to focus on the common Event:

• Event Name: Polling Safety Valve

First take these steps:

• Open a REST client.
• Set Content-Type=application/xml

In the open REST client issue a GET against the following URL. Note this can also be done in a browser tab which can make for easier searching.

• DA:8581/rest/eventrules

Find Event with the Name:

• <Name>Polling Safety Valve</Name>

Note the ID of that rule, found above the Name value. Using that ID issue a new GET against the URL:

• DA:8581/rest/eventrules/<ID>

In a support lab the following is an example of the default Event Rule being used.

<EventRule version="1.0.0">

<ID>460</ID>

<Enabled>true</Enabled>

<MetricFamily>

{http://im.ca.com/normalizer}NormalizedDevicePollingStatistics

</MetricFamily>

<Window>300</Window>

<ClearConditionList>

<ClearCondition>

<ClearOperator>LESS_THAN</ClearOperator>

<ClearValue>1</ClearValue>

</ClearCondition>

</ClearConditionList>

<Duration>300</Duration>

<Severity>MAJOR</Severity>

<AggregateToDevice>false</AggregateToDevice>

<ViolationConditionList>

<ViolationCondition>

<ViolationConditionType>CONSTANT</ViolationConditionType>

<ViolationPerformanceMetric>IsPollingStoppedDueToPriorTimeouts</ViolationPerformanceMetric>

<ViolationOperator>GREATER_THAN_OR_EQUAL_TO</ViolationOperator>

<ViolationValue>1</ViolationValue>

</ViolationCondition>

</ViolationConditionList>

<Item version="1.0.0">

<Name>Polling Safety Valve</Name>

<Description>Polling stopped due to timeouts</Description>

<CreateTime>Mon Sep 30 12:12:36 2019 -0400</CreateTime>

</Item>

</EventRule>

Edit the <Enabled> value from MAJOR to MINOR to lower the Severity. Can also raise Severity by changing it to CRITICAL. We do that by:

• Set REST client to issue a PUT.
• Set the URL to:
  • DA:8581/rest/eventrules/<ID>
• Add the following to the body section:

<EventRule version="1.0.0">
<Severity>MINOR</Severity>
</EventRule>

• Issue the PUT request
• Confirm a "200 Success" message is received.
• Issue the GET against the rule ID URL and confirm the <Severity> value is set to MINOR.

Once completed new instances of this Event will be raised using the different new Severity value set.

Additional Information

• This change is not possible on system based out of the box Administration Events, those not based on a Threshold Violation. Please review the following Knowledge Base article for more information.
  • Edit system Administration Event Severity in Performance Management
• This change is preserved during Data Aggregator restarts.
• If there are changes to default Events this change can be reverted during product upgrades. Ensure modified Severity values are set as needed post upgrade.
• To fully disable a system Event instead of changing Severity please review the following Knowledge Base article for more information.
  • Polling timeout error Events raised in Performance Management
• What do Event Severity numeric values mean in Event Details views in Performance Management UI? Please review the following Knowledge Base article for more information.
  • Event Severity values in Performance Management