Configuring Run Book Automation Policies

Download this manual as a PDF file

This section describes how to configure and use the automation policies in the "Datacenter Advanced Enrichment Policies" PowerPacks.

Use the following menu options to navigate the SL1 user interface:

  • To view a pop-out list of menu options, click the menu icon ().
  • To view a page containing all of the menu options, click the Advanced menu icon ().

Prerequisites

Before you configure and use an automation policy from one of the "Datacenter Advanced Enrichment Policies" PowerPacks, you will need to make the following decisions:

  • Which set of commands you want to run on a monitored device when an event occurs. There are over 350 run book actions in the "Datacenter Advanced Enrichment Actions" PowerPack that build a list of commands to execute on the monitored device; each run book action builds a different list. This set of actions includes all actions in the PowerPack that do not have the prefix "Enrichment: Util:".

  • What event criteria you want to use to determine when the run book actions will trigger, or the set of rules that an event must match before the automation is executed. This can include matching only specific event policies, event severity, associated devices, and so on. For a description of all the options that are available in automation policies, see the Run Book Automation section.

  • Where the output of the run book actions will be viewed by a user. The output is always available in the Event Actions Log modal accessed on the Events page () or the Event Console (Events > Classic Events).

    Optionally, you can include a run book action in your automation policy to send the output of the automation to an additional location. Typically, the additional location is the ticket that was generated for the event in your ticketing system. If you want to configure an automation policy that sends the output of device-specific run book actions to a ticketing system, you must create or have access to the following additional content that is not supplied in the "Datacenter Advanced Enrichment Actions " PowerPack :

    • A process, either automated or manual, where SL1 events are associated with tickets. Examples of this process include:
      • A user clicking the life ring icon () in the ticket console to create a ticket in the SL1 ticketing system.
      • If your system has been configured so that the Events page () or the Event Console (Events > Classic Events) integrates with an external ticketing system, a user clicking the Actions button () and selecting Create Ticket, or clicking the life ring icon () to request a ticket in your external ticketing system.
      • An automation policy that is configured to automatically create tickets for events, either in SL1 or an external ticketing system.
    • A run book action that sends the output from the previous run book action to the ticketing system. This action should specify that the ticket associated with the triggering event will be updated with this information.

Customizing a Datacenter Advanced Enrichment Automation Policy

You can use the default automation policies in the "Datacenter Advanced Enrichment Policies" PowerPacks, or you can customize the policies as needed.

To customize an automation policy:

  1. Go to the Automation Policy Manager page (Registry > Run Book > Automation).
  1. Search for the Datacenter Advanced Enrichment automation policy you want to edit and click the wrench icon () for that policy . The Automation Policy Editor page appears:

  1. Complete the following fields as needed:

  • Policy Name. Type a new name for the automation policy to avoid overwriting the default policy.

  • Policy Type. Select whether the automation policy will match events that are active, match when events are cleared, or run on a scheduled basis. Typically, you would select Active Events in this field. If you want your users to be able to initiate and run this policy on an event from the Event Console or Business Services viewer, select Active Events/User Initiated in this field., For more information, see Creating an Automation Policy.

    The Active Events/User Initiated policy type is available in SL1 version 10.1 and higher.

  • Policy State. Specifies whether the policy will be evaluated against the events in the system. If you want this policy to begin matching events immediately, select Enabled.

  • Organization. Select the organization that will use this policy. The automation policy will execute only for devices in the selected organization that match the other criteria in the policy. To configure a policy to execute for all devices in all organizations that match the other criteria in the policy, select System.

  • Aligned Actions. To create a valid automation policy that uses the run book actions from the "Datacenter Advanced Enrichment Actions" PowerPack, you must configure the Aligned Actions field to include multiple actions in a specific sequence. To add an action to the Aligned Actions field, select the action in the Available Actions field and click the right arrow (>>). To re-order the actions in the Aligned Actions field, select an action and use the up arrow or down arrow buttons on the right to change that action's position in the sequence.

    [Aligned Actions: Non-ticketing Option]

    • If you are not configuring this automation policy to send the output of the run book actions to a ticketing system and users will view the output in the Event Actions Log modal accessed on the Events page () or the Event Console (Events > Classic Events), you must include four actions in the following sequence in the Aligned Actions field:

    1. An "Enrichment" run book action from the "Datacenter Advanced Enrichment Actions" PowerPack that builds a list of commands to execute on the monitored device. There are over 350 different actions of this type. This set of actions includes all actions in the "Datacenter Advanced Enrichment Actions" PowerPack that do not have the prefix "Enrichment: Util:". In most cases, this action will be a device-specifc "Enrichment" action.
    2. The "Enrichment: Util: Collect Enrichment Data" run book action. This action executes the list of commands provided by the previous action and sends the output to the next run book action in the sequence of actions.
    3. The "Enrichment: Util: Format Command Output as HTML" run book action. This action formats the output of the "Enrichment: Util: Collect Enrichment Data" run book action in HTML format.
    4. The "Enrichment: Util: Load Work Instructions" run book action. If the library of work instructions included with the PowerPack contains a set of instructions for the event policy that triggered the event, the run book action will output that set of work instructions.

    [Aligned Actions: Ticketing Option]

    If you are configuring the automation policy to send the output of the run book actions to a ticketing system, you must include six actions in a specific sequence in the Aligned Actions field:

    1. An "Enrichment" run book action from the "Datacenter Advanced Enrichment Actions" PowerPack that builds a list of commands to execute on the monitored device. This set of actions includes all actions from the "Datacenter Advanced Enrichment Actions" PowerPack that do not have the prefix "Enrichment: Util". In most cases, this action will be a device-specific "Enrichment" action.
    2. The "Enrichment: Util: Collect Enrichment Data" run book action. This action executes the list of commands provided by the previous action and sends the output to the next run book action in the sequence of actions.
    3. One of the following actions, which format the output of the "CMS: Util: Collect Enrichment Data" run book action:
    • The "Enrichment: Util: Format Command Output as HTML" run book action. This action formats the output of the "Enrichment: Util: Collect Enrichment Data" run book action in HTML format.
    • The "Enrichment: Util: Format Command Output as Plaintext" run book action. This action formats the output of the "Enrichment: Util: Collect Enrichment Data" run book action in plain-text format.
    1. A run book action that performs a request to add the output of the previous action as a work note in your ticketing system. This run book action is not  supplied in the "Datacenter Advanced Enrichment Actions" PowerPack. See the Prerequisites section for more information about the requirements for this action.
    2. The "Enrichment: Util: Load Work Instructions" run book action. If the library of work instructions included with the PowerPack contains a set of instructions for the event policy that triggered the event, the run book action will output that set of work instructions.
    3. A run book action that performs a request to add the output of the previous action as a work note in your ticketing system. This run book action should be the same run book action you added in the 4th position in this sequence of run book actions.
  1. Optionally, supply values in the other fields on the Automation Policy Editor page to refine when the automation will trigger.

If you are configuring the automation policy to send the output of the run book actions to a ticketing system, you should ensure that the process for associating a ticket with the SL1 event occurs before this automation policy triggers. Typically, you would use the "and ticket IS created" or "and external ticket IS created" options in the Criteria Logic fields.

  1. Click Save.

Removing an Automation Policy from a PowerPack

After you have customized a policy from a "Datacenter Advanced Enrichment" PowerPack, you might want to remove that policy from that PowerPack to prevent your changes from being overwritten if you update the PowerPack later. If you have the license key with author's privileges for a PowerPack, or if you have owner/administrator privileges with your license key, you can remove content from a PowerPack.

If you have version 105 or later of the "Datacenter Automation Utilities" PowerPack installed, you can use the "Automation Utilities: Remove Automation Policies from PowerPack" run book action to remove automation policies from a specific PowerPack.

To remove content from a PowerPack:

  1. Go to the PowerPack Manager page (System > Manage > PowerPacks).
  2. Find the "Datacenter Advanced Enrichment" PowerPack that you want to edit. Click its wrench icon ().
  3. In the PowerPack Properties page, in the Navbar on the left side, click Run Book Policies.
  4. In the Embedded Run Book Polices pane, locate the policy you updated and click the garbage can icon () for that policy. The policy will be removed from the PowerPack and will now appear in the bottom pane.

Example: Customizing an Automation Policy

This section contains an example of an automation policy that uses a customized automation policy from the "Datacenter Advanced Enrichment: Citrix NetScaler Policies" PowerPack along with a set of run book actions in the "Datacenter Advanced Enrichment Actions" PowerPack.

In this example, we customized a default automation policy from the "Datacenter Advanced Enrichment: Citrix NetScaler Policies" PowerPack to create a ticket in the SL1 ticketing system when the CPU temperature of a Citrix NetScaler device exceeds a threshold:

The customized automation policy uses the following settings:

  • Policy Name. We renamed the policy from "Citrix-NetScaler: CPU Temperature High" to "Citrix-NetScaler: CPU Temperature High - Ticket".
  • Policy Type. The policy is intended to run when an unhealthy event triggers, or is in an active state. Active Events is selected in this field.
  • Policy State. Enabled is selected in this field.
  • Organization. The policy is intended to execute for all devices in the system, regardless of organization, so System is selected in this field.
  • Criteria Logic. The output of the actions will be sent to the SL1 ticketing system. As a result, the policy is configured to execute immediately when a matching event triggers using these criteria: "Severity >= Minor, and no time has elapsed since the first occurrence, and ticket IS created, and all times are valid".
  • Aligned Devices. The policy is configured to trigger for all devices in the system.
  • Aligned Events. The actions selected for the policy collect diagnostic information about Citrix NetScaler device. As a result, the policy is configured to trigger only when the following event is triggered:
    • Citrix-NetScaler: CPU Temperature High
  • Aligned Actions. The output of the actions will be sent to the SL1 ticketing system, which uses the "Create Ticket" run book action, which is not included in the "Datacenter Advanced Enrichment Actions" PowerPack. As a result, the automation includes six actions in the following sequence:
    • Enrichment: Citrix-NetScaler: CPU Temperature High
    • Enrichment: Util: Collect Enrichment Data
    • Enrichment: Util: Format Command Output as HTML
    • Create Ticket
    • Enrichment: Util: Load Work Instructions
    • Create Ticket

When the CPU temperature of a Citrix NetScaler device exceeds a threshold, the SL1 ticketing system creates a ticket, which you can view on the SL1 Tickets page.

You can also view the results of running the automation by going to the Events page (), clicking the Actions button (), and selecting View Automation Actions. You can also go to the Event Console (Events > Classic Events) and click the View Notification Log icon (). The Event Actions Log modal appears: