Creating Run Book Automation Policies

Download this manual as a PDF file

This section describes how to create run book automation policies that use the run book actions in the "Datacenter Advanced Enrichment Actions" PowerPack.

Use the following menu options to navigate the SL1 user interface:

  • To view a pop-out list of menu options, click the menu icon ().
  • To view a page containing all of the menu options, click the Advanced menu icon ().

Prerequisites

Before you create an automation policy using the run book actions in the "Datacenter Advanced Enrichment Actions" PowerPack, you will need to make the following decisions:

  • Which set of commands you want to run on a monitored device when an event occurs. There are over 350 run book actions in the PowerPack that build a list of commands to execute on the monitored device; each run book action builds a different list. This set of actions includes all actions in the PowerPack that do not have the prefix "Enrichment: Util:".
  • What event criteria you want to use to determine when the run book actions will trigger, or the set of rules that an event must match before the automation is executed. This can include matching only specific event policies, event severity, associated devices, and so on. For a description of all the options that are available in Automation Policies, see the Run Book Automation section.
  • Where the output of the run book actions will be viewed by a user. The output is always available in the Event Actions Log modal accessed through the Events page () or the Event Console (Events > Classic Events). Optionally, you can include an additional run book action in your automation policy to send the output of the automation to an additional location. Typically, the additional location is the ticket that was generated for the event in your ticketing system. If you want to configure an Automation Policy that sends the output of the run book actions in the "Datacenter Advanced Enrichment Actions" PowerPack to a ticketing system, you must create or have access to the following additional content that is not supplied in the "Datacenter Advanced Enrichment Actions" PowerPack:
    • A process, either automated or manual, where SL1 events are associated with tickets. Examples of this process include:
      • A user clicking the life ring icon () on the Tickets page to create a ticket in the SL1 ticketing system.
      • If your system has been configured so that the Events page () or the Event Console (Events > Classic Events) integrates with an external ticketing system, a user clicking the Actions button () and selecting Create Ticket, or clicking the life ring icon () to request a ticket in your external ticketing system.
      • An run book automation policy that is configured to automatically create tickets for events, either in SL1 or an external ticketing system.
    • A run book action that sends the output from the previous run book action to the ticketing system. This action should specify that the ticket associated with the triggering event will be updated with this information.

Creating a Run Book Automation Policy

To create a run book automation policy that uses the run book actions in the "Datacenter Advanced Enrichment Actions" PowerPack:

  1. Go to the Automation page (Registry > Run Book > Automation).
  1. Click Create. The Automation Policy Editor page appears.
  2. Complete the following required fields:

  • Policy Name. Enter a name for the run book automation policy.

  • Policy Type. Select whether the automation policy will match events that are active, match when events are cleared, or run on a scheduled basis. Typically, you would select Active Events in this field.

  • Policy State. Specifies whether the policy will be evaluated against the events in the system. If you want this policy to begin matching events immediately, select Enabled.

  • Organization. Select the organization that will use this policy. The automation policy will execute only for devices in the selected organization that match the other criteria in the policy. To configure a policy to execute for all devices in all organizations that match the other criteria in the policy, select System.

  • Aligned Actions (bottom right). To create a valid automation policy that uses the run book actions in the "Datacenter Advanced Enrichment Actions" PowerPack, you must configure the Aligned Actions field on this page to include multiple actions in a specific sequence. To add an action to the Aligned Actions field, select the action in the Available Actions field and click the right arrow (>>). To re-order the actions in the Aligned Actions field, select an action and use the up arrow or down arrow buttons to change that action's position in the sequence.

    If you are not configuring the automation policy to send the output of the run book actions to a ticketing system, if users will view the output in the Event Actions Log modal accessed through the Events page () or the Event Console (Events > Classic Events), the automation must include four actions in the following sequence:

    1. A run book action from this PowerPack that builds a list of commands to execute on the monitored device. There are over 350 different actions of this type. This set of actions includes all actions in the PowerPack that do not have the prefix "Enrichment: Util:".
    2. The "Enrichment: Util: Collect Enrichment Data" run book action. This action executes the list of commands provided by the previous action and sends the output to the next run book action in the sequence of actions.
    3. The "Datacenter Automation: Format Output as HTML" run book action. This action formats the output of the "Enrichment: Util: Collect Enrichment Data" run book action in HTML format. This formatting action is provided by the "Datacenter Automation Utilities" PowerPack, which must be installed to use this run book action.
    4. The "Enrichment: Util: Load HTML Work Instructions" run book action. If the library of work instructions included with the PowerPack contains a set of instructions for the event policy that triggered the event, this run book action will output that set of work instructions to HTML.

    If you are configuring the automation policy to send the output of the run book actions to a ticketing system, the automation must include six actions in a specific sequence:

    1. A run book action from this PowerPack that builds a list of commands to execute on the monitored device. There are over 350 different actions of this type. This set of actions includes all actions in the PowerPack that do not have the prefix "Enrichment: Util".
    2. The "Enrichment: Util: Collect Enrichment Data" run book action. This action executes the list of commands provided by the previous action and sends the output to the next run book action in the sequence of actions.
    3. The "Enrichment: Util: Format Command Output as HTML" run book action, which formats the output of the "Enrichment: Util: Collect Enrichment Data" run book action in HTML format.
    4. A run book action that performs a request to add the output of the previous action as a work note in your ticketing system. This run book action is not supplied in the "Datacenter Automation Utilities" PowerPack. See the Prerequisites section for more information about the requirements for this action.
    5. The "Enrichment: Util: Load HTML Work Instructions" or "Enrichment: Util: Load Plaintext Work Instructions" run book action. If the library of work instructions included with the PowerPack contains a set of instructions for the event policy that triggered the event, the run book action will output that set of work instructions. Select the HTML or Plaintext action, depending on the format accepted by your ticketing system.
    6. A run book action that performs a request to add the output of the previous action as a work note in your ticketing system. This should be the same run book action you added in the 4th position in the sequence of run book actions. This run book action is not supplied in the "Datacenter Automation Utilities" PowerPack. See the Prerequisites section for more information about the requirements for this action.
  1. Optionally, supply values in the other fields on this page to refine when the automation will trigger. If you are configuring the automation policy to send the output of the run book actions to a ticketing system, you should ensure that the process for associating a ticket with the SL1 event occurs before this automation policy triggers. Typically, you would use the "and ticket IS created" or "and external ticket IS created" options in the Criteria Logic fields to do this.
  2. Click Save.

After you have configured one or more automation policies that use the run book actions in the "Datacenter Automation Utilities" PowerPack, you must configure credentials for the run book actions to use. See the Configuring Device Credentials chapter for instructions on how to do this.

Example Automation Configuration

The following is an example of a run book automation policy that uses the run book actions in the "Datacenter Advanced Enrichment Actions" PowerPack:

The automation policy uses the following settings:

  • Policy Name. The policy is named "Cisco UCS Fabric Incident Enrichment".
  • Policy Type. The policy is intended to run when an unhealthy event triggers, or is in an active state. Active Events is selected in this field.
  • Policy State. Enabled is selected in this field.
  • Organization. The policy is intended to execute for all devices in the system, regardless of organization, so System is selected in this field.
  • Criteria Logic. The output of the actions will be viewed via the Event Actions Log modal accessed on the Events page () or the Event Console (Events > Classic Events), and the actions in the policy are not configured to output to a ticket. As a result, the policy is configured to execute immediately when a matching event triggers using these criteria: "Severity >= Minor, and no time has elapsed since the first occurrence, and event is NOT cleared, and all times are valid".
  • Aligned Devices. The policy is configured to trigger for all devices in the system.
  • Aligned Events. The actions selected for the policy collect diagnostic information about UCS Fabric components. Therefore, the policy is configured to trigger only when the following events are triggered:
    • Cisco: UCS Fabric PSU Amperes has exceeded threshold
    • Cisco: UCS Fabric PSU Voltage has exceeded threshold
    • Cisco: UCS Fabric PSU Wattage has exceeded threshold
  • Aligned Actions. Users will view the output of the run book actions in the Event Actions Log modal accessed through the Events page () or the Event Console (Events > Classic Events). Therefore, the automation includes four actions in the following sequence:
    • Enrichment: Cisco-UCS: Fabric Show Commands
    • Enrichment: Util: Collect Enrichment Data
    • Enrichment: Util: Format Command Output as HTML
    • Enrichment: Util: Load Work Instructions

Run Book Actions in the Datacenter Automation Utilities PowerPack

You can use the following run book action policies to perform specific actions as part of the run book automations in the "Datacenter Automation Utilities" PowerPack.

  • Automation Utilities: Calculate Memory Size for Each Action. Manages memory allocation for other run book actions that are included in the automation policy aligned with this action. This action should be at the start of a run book automation policy that includes multiple run book actions that collect data.

    This run book action manages memory allocation for the following actions and PowerPacks:

    • "Network Connectivity" run book actions from this PowerPack; for more information, see Configuring Network Connectivity Automations
    • "Linux SSH Automations" PowerPack
    • "VMware Automation" PowerPack
    • "Windows PowerShell Automations" PowerPack

  • Automation Utilities: Change Enrichment Formatting to SN Scoped. Where applicable, changes all of the run book automation policies in the specified Automation PowerPack to use the "Datacenter Automation: Format Output for ServiceNow Scoped" run book action instead of the "Datacenter Automation: Format Output as HTML" action. You can specify the target PowerPack with the powerpack_guid field. For more information, see Sending Enrichment Output to a ServiceNow Integration.

  • Automation Utilities: Connect Enrichment Automations to SN. Where applicable, changes all the run book automation policies in the specified Automation PowerPack to use the "Datacenter Automations: Update ServiceNow Incident" run book action in place of the "Enrichment: Util: Load HTML Work Instructions" action. You can specify the target PowerPack with the powerpack_guid field. For more information, see Sending Enrichment Output to a ServiceNow Integration.

  • Automation Utilities: Remove Automation Policies from PowerPack. Unaligns all of the automation policies from the specified Automation PowerPack to prevent any changes made to the automation policy from being overwritten when the PowerPack is updated on that SL1 system. You can specify the target PowerPack with the powerpack_guid field. For more information, see Removing Automation Policies from a PowerPack.

  • Datacenter Automation: Add Commands to Device Log. Adds a device log entry that includes a list of commands for any run book action that executed a command on a device. This run book action must come after the command execution action in the associated run book automation policy.

    For example, you should add this run book action after the "Linux CPU Diagnostic Commands" run book action in Aligned Actions field of the automation policy.

  • Datacenter Automation: Format HTML Output for ServiceNow Scoped. Formats the command-list execution output into a human-readable format, and then formats the output into a dictionary for ServiceNow to accept for a scoped integration. You should add this run book action after the command execution action in the associated run book automation policy.

    This action is intended to be used with the "Datacenter Automations: Update ServiceNow Incident" run book action.

  • Datacenter Automation: Format JSON as simple HTML. Formats the HTTP JSON response from the previous run book action into a human-readable HTML-based format and presents the output in the standard SL1 run book automation output. You should add this action after an HTTP request run book action in the associated automation policy. For more information, see Configuring Network Request Run Book Actions.

  • Datacenter Automation: Format Output as HTML. Formats the command-list execution output into a human-readable HTML-based format and presents the output in the standard SL1 run book automation output. You should add this action after the command execution action in the associated automation policy.

  • Datacenter: Automation Format Output for ServiceNow Non-Scoped. Formats the command-list execution output into a dictionary for ServiceNow to accept for a non-scoped integration. You should add this action after the command execution action in the associated automation policy.

    This action is intended to be used with the "Datacenter Automations: Update ServiceNow Incident" run book action.

  • Datacenter Automation: Format Output for ServiceNow Scoped. Formats the command-list execution output into a dictionary for ServiceNow to accept for a scoped integration. This action should come after the command execution action in the associated automation policy.

    This action is intended to be used with the "Datacenter Automations: Update ServiceNow Incident" run book action.

  • Datacenter Automations: Update ServiceNow Incident. Updates a ServiceNow incident with enrichment data collected by an enrichment automation action.