Designing and Managing Behavior Models
-
Using Other Data Sources - HP OpenView IT/Operations - Writing an OpC Trigger Function -
If an OpC mask cannot completely describe the type of message it is looking for by specifying the contents of the message's Application, Group, Type, Object, and Severity fields, it must contain a trigger function. This function, which you write using Perl 5, can include additional conditions that the message must meet, and it can fire different triggers as appropriate.
Most OpC trigger functions are very similar in structure. They follow this pattern:
if (condition1) {
FireTrigger(arguments);
}
elsif (condition2) {
FireTrigger(arguments);
}
else {
FireTrigger(arguments);
}
The conditions can test the value of any the following message attributes:
For example, suppose that you want to create an OpC mask that detects IT/O messages concerning unsuccessful attempts to switch users to root. This mask would require a trigger function that checked a message's message text for the string "Bad switch user to root." (For details on how to implement this trigger function, see the section Examples of OpC Trigger Functions.)
To assist you in writing OpC trigger functions, NerveCenter provides:
For further information about these predefined functions and variables and the pop-up help menu, see the following sections:
NerveCenter provides a number of functions (actually Perl subroutines) that facilitate the writing of OpC trigger functions. The list below indicates what types of functions are available and where you can find detailed information about each function:
For reference information about these functions, see the section String-Matching Functions.
For reference information about this function, see the section FireTrigger() Function.
NerveCenter defines several variables for use in OpC trigger functions. These variables contain the values of fields in the IT/O message that NerveCenter is examining.
The complete list of variables that you can use in an OpC trigger function is shown in the table below:
Variables Used in OpC Trigger Functions
| Variable | Description |
|---|---|
Contains the value of the message's node field. The node referred to in this field is the one on which the condition being reported occurred. | |
To see how these variables might be used in context, see the section Examples of OpC Trigger Functions.
This section presents a couple of example OpC trigger functions and explains what the functions do.
Here's a simple example. Suppose that you're monitoring Sun workstations for disk usage and that you want to fire one trigger if a file server's disk usage crosses a certain threshold and another trigger if the disk usage at a user's workstation crosses that threshold. The first trigger will cause an alarm to transition to a state of Major severity, and the second will cause a transition to a state of minor severity.
The trigger function might look like this.
if ($OpCNodeName eq "FileServer1" or
$OpCNodeName eq "FileServer2" ...) {
FireTrigger("lowDiskServer", $DefaultSubobject);
}
else {
FireTrigger("lowDiskNonserver", $DefaultSubobject);
}
Note the second argument to FireTrigger(), the subobject argument. In the context of an IT/O message, a subobject of the form baseObject.instance makes no sense, so by default NerveCenter uses a subobject of the form $OpCGroup.$OpCObject. This definition of a subobject enables you to create subobject-scope alarms that are driven by triggers fired from OpC masks.
The following trigger function looks for unsuccessful attempts to su (switch users) to root by users who don't have permission to become root:
if ((ContainsWord($OpCMessage, "Bad switch user to root")) and
($OpCObject ne "authorizedUser1") and
($OpCObject ne "authorizedUser2") ...) {
FireTrigger("badSuToRoot");
}
The call to ContainsWord() determines whether the message's message text contains the string "Bad switch user to root," and the expressions containing the variable $OpCOjbect determine whether the user who attempted the su is authorized to become root. (In this type of message, the object field contains the name of the user who issued the su command.)
| Previous: Defining an OpC Mask | Next: Documenting an OpC Mask |
| Please send comments or corrections to Information Development | This file was last updated on 10 October 2000 |