CA creation in the policy or during event processing?

Hi Misaq,

in the policy.

BR,

Rodrigo

My knowledge a bit dated but may be similar.

In the policy rule page you can set a variable in the variable binding and then use the variable value to set the Custom attribute...

example:  var binding     $7              <*> \[BD_EXAMPLE-<*.ret>\]$

Custom attribute:      RET    <ret>

I thought this way, but I believe that by setting this pattern for varbind $7, I am creating a filter and only those who meet this pattern will pass, that is, I would have to create this specific rule and maintain a more generic one, correct Misaq?

Hello,

Looks like you have a condition that works.

Maybe this helps going forward: when testing, you cna use the logfile encapsulator policy type as it has the magic bottle that you can use to test your policy.  It's an easy way to get your condition working.  Once finished, cut/paste the rule to (in this case) the policy type you are using.  By the way, you can match on the whole line (escaping the [] as you've already done):

Then:

This creates a filter so if this rule matches the condition, the event will be generated.  You can use a not  (!) condition or OR condition within the rule.  i'm not sure the logic you are trying to use.  If you need to match this exact condition and match something more generic, then you can copy the rule and use rule ordering.

There is also a variable called eaagt called OPC_SEND_MAX_ONE_MSG_PER_TRAP which controls processing of additional trap templates, if a message was already generated from a template. This speeds up processing, but may prevent some templates from even 'looking' at the trap. As a result, less messages might be sent to the server and the behavior of duplicate suppression for 'Suppress Messages Matching Condition' may change. Default is false so all polices are evaluated.  Please note that it is not possible to specify which order policies are processed so use with care.

I hope this helps.

One interesting thing you could do is if you just want to play with custom attribute. As $7 is already available you could use following:

Pattern Matching for Variables - Operations Bridge Manager

Hello, 

I don't think that works because you can use $MATCH within your policies in the following event attributes:

• Application
• Automatic Command
• Category
• Custom Attributes
• Close Events with Key
• Description
• ETI Hint
• HPOM Service ID
• Key
• Type
• Node
• Object
• Related CI Hint
• Severity
• Source CI Hint
• Subcategory
• Operator-initiated Command
• TimeCreated
• Title

Plus, I don't think there is any benefit from using $MATCH in this example.

Setting start to "suggest as answer".