Event Rules and Actions

Monitoring event rules

Monitoring event rules are used to process monitoring events. The system checks records in the Monitoring Event (itsm_event_rule) table against the event rule. If the records match the rule, the system starts counting down the revalidation period. At the end of this period, the system rechecks whether the Monitoring Event records match the event rule.

info

The revalidation period is not used for the Information events and if the Ignore event correlation checkbox is selected on the event rule form. This means that events that satisfy the conditions of the event rule immediately trigger the related actions.

If you select the Ignore event correlation checkbox, the actions are executed every time, regardless of whether they were previously executed for the event.

To create an event rule, complete the following steps:

1. Navigate to Monitoring and Event Management → Configuration → Event Rules.
2. Click New and fill in the fields.
3. Click Save or Save and exit to apply the changes.

Event Rule form fields

Field	Mandatory	Description
Name	Y	Specify a name for the event rule. The name should be unique.
Description	N	Add a brief description.
Deactivate monitoring event	N	Specify the monitoring deactivation conditions. Available options: One related record matches conditions All related records match conditions The field determines whether it is possible to set the Event deactivation conditions in the Action for event rule. The selected option determines the influence of several records related to the Monitoring event to its deactivation.
Active	N	Select this checkbox to enable the rule.
Type	Y	Specify the event type. Available options: Information – responds to a sequence of informational messages associated with non-critical events. For example, consecutive errors occurred during the user authentication in a short time. Warning – indicates whether one of the service or device parameters has reached a threshold value. Exception – determines whether a metric for a service or a system component has reached a specified breach value.
Message count	Y	Specify the number of the event messages required to execute the current rule. The field appears when the Information type is selected.
Message accumulation period	Y	Specify the period during which the number of event messages specified in the Message count field should be accumulated. The field appears when the Information type is selected.
Active event count	Y	Specify the number of active events in the Monitoring Events (itsm_monitoring_event) table for the rule to work. The field appears when the Warning type is selected.
Ignore event correlation	N	Select this checkbox to ignore the event correlation engine in cases when it is required to create an ITSM record without waiting for the event correlation to be processed. When the checkbox is selected: All actions related to this event rule are performed each time the number of messages in the monitoring event is updated. The Create record and set update script action type becomes available in the Action type field of the Action for Event Rule form. When the checkbox is cleared, all related event rule actions with the Create record and set update script action type are deactivated. These actions cannot be manually activated until the checkbox is selected again. The field appears when the Exception type is selected.
Revalidation period	Y	Specify the time period after which the monitoring events will be rechecked for compliance with the rule. The field appears when the Warning or Exception type is selected.

Action for event rule

---

When the event records are rechecked, and they still match the rule, the system performs all actions created for this event rule in ascending order.

To create actions, complete the following steps:

1. Open the event rule record for which you need to create an action.
2. Navigate to the Related Lists area, select the Action for Event Rule tab.
3. Click New and fill in the fields.
4. Click Save or Save and exit to apply the changes.

note

You can also open the action form via the Navigator menu. To do so, navigate to Monitoring and Event Management → Configuration → Action Event Rules and click New. In this case, you need to fill in the Event rule field manually.

Action for Event Rule form fields

Field	Mandatory	Description
Name	Y	Specify a name of the action.
Event rule	Y	Specify the event rule for which the action is created.
Action type	Y	Choose the action type: Create record – a record is created in the specified Table. Update predefined record – the specified Record is updated according to the Template and Script. Execute user script – the specified Script is executed. Create record and set update script – a record is created in the specified Table. When the rule action is repeated in response to the same event, the target Table record is updated using the Record update script.
Table	Y	Specify the table in which the action should be performed. The field appears when the Create record, Create record and set update script or Update predefined record action type is selected.
Record	Y	Specify the record which should be updated. The field appears when the Update predefined record action type is selected.
Template	N	Select a column and define the value you need. Available columns depend on the table specified in the Table field. The field is hidden when the Execute user script action type is selected.
Use script	N	Select the checkbox to display the Script field. When the Create record and set update script action type is selected, the title is changed to Record creation script.
Script	N	Enter a script using the SimpleOne Server-Side API. The field appears when the Use script option is chosen or when the Execute client script action type is chosen. Use the executeScript() function with the following parameters, which are SimpleRecord objects: event – the record in the Monitoring Event (itsm_monitoring_event) table that is created by the monitoring rule with the lowest order and is related to the current event rule. message – the last record in the Target Message table related to the event. record – the record that is specified in the Record field or created in the specified Table. If the Execute client script type is chosen, the record is null.
Record update script	N	Enter a script using the SimpleOne Server-Side API. The field appears when the Create record and set update script action type is selected.
Active	N	Select this checkbox to enable the action.
Order	N	Specify the action order. Actions are performed in ascending order.
Сonditions for event deactivation	N	Specify the conditions to set the Inactive state for the event when the monitoring event rule is triggered. The field appears when all of the following conditions are met: One of the following options is selected in the Deactivate monitoring event field of the monitoring event rule related to the current action: One related record matches conditions All related records match conditions The Table field is filled. One of the following options is selected in the Action type field: Create record Update predefined record Create record and set update script

When an action of the Create record, Update predefined record, or Create record and set update script type is performed, a new record is created in the && (itsm_task_event) table. This record connects the ITSM Task (itsm_task) record to the Monitoring Event (itsm_monitoring_event) and Action for Event Rule (itsm_action_event_rule) records. If the binding record already exists, a new one is not created.

note

If the record from any ITSM Task child table has related Monitoring Event records, the relevant related list is displayed on its form.

Message processing

---

After setting up all the necessary elements (monitoring source, monitoring rules, monitoring event rules and actions, adding a system user with the monitoring_message_creator and import_admin roles), the system is ready to receive messages from the monitoring systems. When messages are received, SimpleOne analyzes them and, if necessary, performs the specified actions. For example, the system creates an infrastructure incident, updates the operational status of a CI, and others.

Deactivate the events

Each time an ITSM task is updated, it is checked against the Сonditions for event deactivation of the related action within which the task was created or updated.

If the conditions are met and the Deactivate monitoring event field in the related event rule has the One related record matches conditions option selected, the triggering monitoring event is deactivated.

If the All related records match conditions option is selected in the Deactivate monitoring event field of the related event rule, the monitoring event is deactivated only when all ITSM task records associated with the event meet the deactivation conditions.