Creating Run Book Automation Policies

This section describes how to create run book automation policies that use the run book actions in the "Datacenter Advanced Enrichment Actions" PowerPack.

Use the following menu options to navigate the SL1 user interface:

• To view a pop-out list of menu options, click the menu icon ().
• To view a page containing all of the menu options, click the Advanced menu icon ().

Prerequisites

Before you create an automation policy using the run book actions in the "Datacenter Advanced Enrichment Actions" PowerPack, you will need to make the following decisions:

• Which set of commands you want to run on a monitored device when an event occurs. There are over 350 run book actions in the PowerPack that build a list of commands to execute on the monitored device; each run book action builds a different list. This set of actions includes all actions in the PowerPack that do not have the prefix "Enrichment: Util:".
• What event criteria you want to use to determine when the run book actions will trigger, or the set of rules that an event must match before the automation is executed. This can include matching only specific event policies, event severity, associated devices, and so on. For a description of all the options that are available in Automation Policies, see the Run Book Automation section.
• Where the output of the run book actions will be viewed by a user. The output is always available in the Event Actions Log modal accessed through the Events page () or the Event Console (Events > Classic Events). Optionally, you can include an additional run book action in your automation policy to send the output of the automation to an additional location. Typically, the additional location is the ticket that was generated for the event in your ticketing system. If you want to configure an Automation Policy that sends the output of the run book actions in the "Datacenter Advanced Enrichment Actions" PowerPack to a ticketing system, you must create or have access to the following additional content that is not supplied in the "Datacenter Advanced Enrichment Actions" PowerPack:
• A process, either automated or manual, where SL1 events are associated with tickets. Examples of this process include:
• A user clicking the life ring icon () on the Tickets page to create a ticket in the SL1 ticketing system.
• If your system has been configured so that the Events page () or the Event Console (Events > Classic Events) integrates with an external ticketing system, a user clicking the Actions button () and selecting Create Ticket, or clicking the life ring icon () to request a ticket in your external ticketing system.
• An run book automation policy that is configured to automatically create tickets for events, either in SL1 or an external ticketing system.
• A run book action that sends the output from the previous run book action to the ticketing system. This action should specify that the ticket associated with the triggering event will be updated with this information.

Creating a Run Book Automation Policy

To create a run book automation policy that uses the run book actions in the "Datacenter Advanced Enrichment Actions" PowerPack:

1. Go to the Automation page (Registry > Run Book > Automation).

2. Click Create. The Automation Policy Editor page appears.
3. Complete the following required fields:

• Policy Name. Enter a name for the run book automation policy.

• Policy Type. Select whether the automation policy will match events that are active, match when events are cleared, or run on a scheduled basis. Typically, you would select Active Events in this field.

• Policy State. Specifies whether the policy will be evaluated against the events in the system. If you want this policy to begin matching events immediately, select Enabled.

• Organization. Select the organization that will use this policy. The automation policy will execute only for devices in the selected organization that match the other criteria in the policy. To configure a policy to execute for all devices in all organizations that match the other criteria in the policy, select System.

• Aligned Actions (bottom right). To create a valid automation policy that uses the run book actions in the "Datacenter Advanced Enrichment Actions" PowerPack, you must configure the Aligned Actions field on this page to include multiple actions in a specific sequence. To add an action to the Aligned Actions field, select the action in the Available Actions field and click the right arrow (>>). To re-order the actions in the Aligned Actions field, select an action and use the up arrow or down arrow buttons to change that action's position in the sequence.

  If you are not configuring the automation policy to send the output of the run book actions to a ticketing system, if users will view the output in the Event Actions Log modal accessed through the Events page () or the Event Console (Events > Classic Events), the automation must include four actions in the following sequence:

1. A run book action from this PowerPack that builds a list of commands to execute on the monitored device. There are over 350 different actions of this type. This set of actions includes all actions in the PowerPack that do not have the prefix "Enrichment: Util:".
2. The "Enrichment: Util: Collect Enrichment Data" run book action. This action executes the list of commands provided by the previous action and sends the output to the next run book action in the sequence of actions.
3. The "Datacenter Automation: Format Output as HTML" run book action. This action formats the output of the "Enrichment: Util: Collect Enrichment Data" run book action in HTML format. This formatting action is provided by the "Datacenter Automation Utilities" PowerPack, which must be installed to use this run book action.
4. The "Enrichment: Util: Load HTML Work Instructions" run book action. If the library of work instructions included with the PowerPack contains a set of instructions for the event policy that triggered the event, this run book action will output that set of work instructions to HTML.

If you are configuring the automation policy to send the output of the run book actions to a ticketing system, the automation must include six actions in a specific sequence:

1. A run book action from this PowerPack that builds a list of commands to execute on the monitored device. There are over 350 different actions of this type. This set of actions includes all actions in the PowerPack that do not have the prefix "Enrichment: Util".
2. The "Enrichment: Util: Collect Enrichment Data" run book action. This action executes the list of commands provided by the previous action and sends the output to the next run book action in the sequence of actions.
3. The "Enrichment: Util: Format Command Output as HTML" run book action, which formats the output of the "Enrichment: Util: Collect Enrichment Data" run book action in HTML format.
4. A run book action that performs a request to add the output of the previous action as a work note in your ticketing system. This run book action is not supplied in the "Datacenter Automation Utilities" PowerPack. See the Prerequisites section for more information about the requirements for this action.
5. The "Enrichment: Util: Load HTML Work Instructions" or "Enrichment: Util: Load Plaintext Work Instructions" run book action. If the library of work instructions included with the PowerPack contains a set of instructions for the event policy that triggered the event, the run book action will output that set of work instructions. Select the HTML or Plaintext action, depending on the format accepted by your ticketing system.
6. A run book action that performs a request to add the output of the previous action as a work note in your ticketing system. This should be the same run book action you added in the 4th position in the sequence of run book actions. This run book action is not supplied in the "Datacenter Automation Utilities" PowerPack. See the Prerequisites section for more information about the requirements for this action.

3. Optionally, supply values in the other fields on this page to refine when the automation will trigger. If you are configuring the automation policy to send the output of the run book actions to a ticketing system, you should ensure that the process for associating a ticket with the SL1 event occurs before this automation policy triggers. Typically, you would use the "and ticket IS created" or "and external ticket IS created" options in the Criteria Logic fields to do this.
4. Click Save.

After you have configured one or more automation policies that use the run book actions in the "Datacenter Automation Utilities" PowerPack, you must configure credentials for the run book actions to use. See the Configuring Device Credentials chapter for instructions on how to do this.

Example Automation Configuration

The following is an example of a run book automation policy that uses the run book actions in the "Datacenter Advanced Enrichment Actions" PowerPack:

The automation policy uses the following settings:

• Policy Name. The policy is named "Cisco UCS Fabric Incident Enrichment".
• Policy Type. The policy is intended to run when an unhealthy event triggers, or is in an active state. Active Events is selected in this field.
• Policy State. Enabled is selected in this field.
• Organization. The policy is intended to execute for all devices in the system, regardless of organization, so System is selected in this field.
• Criteria Logic. The output of the actions will be viewed via the Event Actions Log modal accessed on the Events page () or the Event Console (Events > Classic Events), and the actions in the policy are not configured to output to a ticket. As a result, the policy is configured to execute immediately when a matching event triggers using these criteria: "Severity >= Minor, and no time has elapsed since the first occurrence, and event is NOT cleared, and all times are valid".
• Aligned Devices. The policy is configured to trigger for all devices in the system.
• Aligned Events. The actions selected for the policy collect diagnostic information about UCS Fabric components. Therefore, the policy is configured to trigger only when the following events are triggered:
• Cisco: UCS Fabric PSU Amperes has exceeded threshold
• Cisco: UCS Fabric PSU Voltage has exceeded threshold
• Cisco: UCS Fabric PSU Wattage has exceeded threshold
• Aligned Actions. Users will view the output of the run book actions in the Event Actions Log modal accessed through the Events page () or the Event Console (Events > Classic Events). Therefore, the automation includes four actions in the following sequence:
• Enrichment: Cisco-UCS: Fabric Show Commands
• Enrichment: Util: Collect Enrichment Data
• Enrichment: Util: Format Command Output as HTML
• Enrichment: Util: Load Work Instructions

Run Book Actions in the Datacenter Automation Utilities PowerPack

The following table lists the run book action policies included in the "Datacenter Automation Utilities" PowerPack:

Automation Policy Name	Description
Automation Utilities: Calculate Memory Size for Each Action	Manages memory allocation with actions that are included in a single automation policy. This run book action manages memory allocation when multiple run book actions from the following PowerPacks are included in a single automation policy: Linux SSH Automation Network Connectivity Automation VMware Automation Windows PowerShell Automations This automation should be at the start of an automation policy that includes multiple run book actions that collect data.
Automation Utilities: Change Enrichment Formatting to SN Scope	Formats an action to plain text. Available for all Automation PowerPacks.
Automation Utilities: Connect Enrichment Automations to SN	Changes all the automation policies in the "Datacenter Advanced Enrichment Actions" PowerPack from the default configuration to the standard ServiceNow configuration.
Automation Utilities: Integrate Automations with SNOW Scoped	Updates the run book actions for a specified PowerPack so that PowerPack sends enrichment output to a ServiceNow integration. Uses the following policies: Automation Utilities: Request to Migrate Datacenter Advanced Enrichment Policies to ServiceNow (event policy) Automation Utilities: Change Enrichment Formatting to SN Scoped (run book action policy) Automation Utilities: Connect Enrichment Automations to SN (run book action policy)
Automation Utilities: Remove Automation Policies from PowerPack	Unaligns all the automation policies in the "Datacenter Advanced Enrichment Actions" PowerPack to prevent any changes made to the automation policy from being overwritten when the PowerPack is updated. Uses the following policies: Automation Utilities: Request to Remove Datacenter Advanced Enrichment Policies from PowerPack (event policy) Automation Utilities: Remove Automation Policies from PowerPack (run book action policy)
Datacenter Automation: Add Commands to Device Log	Adds a device log entry that includes a list of commands for any action that executed a command on a device. Available for all Automation PowerPacks.
Datacenter Automation: Format Output as HTML	Formats the command-list execution output into a human-readable format and presents the output in standard SL1 run book automation output. This run book action is not impacted by the preceding actions in the associated automation policy. Available for all Automation PowerPacks.
Datacenter: Automation Format Output for ServiceNow Non-Scoped	Formats the command-list execution output into a dictionary for ServiceNow to accept for a non-scoped integration. This run book action is not impacted by the preceding actions in the associated automation policy. Available for all Automation PowerPacks.
Datacenter Automation: Format Output for ServiceNow Scoped	Formats the command-list execution output into a dictionary for ServiceNow to accept for a non-scoped integration. This run book action is not impacted by the preceding actions in the associated automation policy. Available for all Automation PowerPacks.
Datacenter Automation: Format HTML Output for ServiceNow Scoped	Formats the command-list execution output into a human-readable format, and into a dictionary for ServiceNow to accept. Presents as human-readable output for standard SL1 run book automation output on an event on a device. Also presents as human-readable output for a ServiceNow Incident as a "work notes" entry. This run book action is not impacted by the preceding actions in the associated automation policy. Available for all Automation PowerPacks.
Datacenter Automations: Update ServiceNow Incident	Adds a note to a ServiceNow incident with diagnostic information that was collected by SL1. Available for all Automation PowerPacks.