This
These general-purpose run book actions and run book automation policies let you modify the output formatting of an enrichment action, send enrichment data to ServiceNow integrations, and supplement the execution of enrichment actions.
You can also configure run book actions and run book automations to collect additional diagnostic information when events occur and to provide instructions on how to troubleshoot issues. This additional information about an event is intended to assist the engineer responsible for troubleshooting and resolving that event.
Automation Utilities Run Book Automation Policies
The following table lists the "Automation Utilities" run book automation policies included in the "Datacenter Automation Utilities" PowerPack:
| Automation Policy Name | Aligned Events | Run Book Action |
|---|---|---|
|
Automation Utilities: Integrate Automations with SNOW Scoped For more information, see Sending Enrichment Output to a ServiceNow Integration. |
|
|
|
Automation Utilities: Remove Automation Policies from PowerPack For more information, see Removing Automation Policies from a PowerPack. |
|
|
To use these run book automation policies, you will need to enable each policy, as the policies are disabled by default.
Automation Utilities, Datacenter Automation, and Enrichment: Util Run Book Actions
The general-purpose run book actions and run book automation policies in the "Datacenter Automation Utilities" PowerPack help with modifying the output formatting of an enrichment action, sending enrichment data to ServiceNow integrations, or otherwise supplementing the execution of enrichment actions.
You can use the following run book action policies to perform specific actions as part of the run book automations in the "Datacenter Automation Utilities" PowerPack.
-
Automation Utilities: Calculate Memory Size for Each Action. Manages memory allocation for other run book actions that are included in the automation policy aligned with this action. This action should be at the start of a run book automation policy that includes multiple run book actions that collect data.
This run book action manages memory allocation for the following actions and PowerPacks:
- "Network Connectivity" run book actions from this PowerPack; for more information, see Configuring Network Connectivity Automations.
- "Linux SSH Automations" PowerPack
- "VMware Automation" PowerPack
- "Windows PowerShell Automations" PowerPack
-
Automation Utilities: Change Enrichment Formatting to SN Scoped. Where applicable, changes all of the run book automation policies in the specified Automation PowerPack to use the "Datacenter Automation: Format Output for ServiceNow Scoped" run book action instead of the "Datacenter Automation: Format Output as HTML" action. You can specify the target PowerPack with the powerpack_guid field. For more information, see Sending Enrichment Output to a ServiceNow Integration.
-
Automation Utilities: Connect Enrichment Automations to SN. Where applicable, changes all the run book automation policies in the specified Automation PowerPack to use the "Datacenter Automations: Update ServiceNow Incident" run book action in place of the "Enrichment: Util: Load HTML Work Instructions" action. You can specify the target PowerPack with the powerpack_guid field. For more information, see Sending Enrichment Output to a ServiceNow Integration.
-
Automation Utilities: Remove Automation Policies from PowerPack. Unaligns all of the automation policies from the specified Automation PowerPack to prevent any changes made to the automation policy from being overwritten when the PowerPack is updated on that SL1 system. You can specify the target PowerPack with the powerpack_guid field. For more information, see Removing Automation Policies from a PowerPack.
-
Datacenter Automation: Add Commands to Device Log. Adds a device log entry that includes a list of commands for any run book action that executed a command on a device. This run book action must come after the command execution action in the associated run book automation policy.
For example, you should add this run book action after the "Linux CPU Diagnostic Commands" run book action in Aligned Actions field of the automation policy.
-
Datacenter Automation: Format HTML Output for ServiceNow Scoped. Formats the command-list execution output into a human-readable format, and then formats the output into a dictionary for ServiceNow to accept for a scoped integration. You should add this run book action after the command execution action in the associated run book automation policy.
This action is intended to be used with the "Datacenter Automations: Update ServiceNow Incident" run book action.
-
Datacenter Automation: Format JSON as simple HTML. Formats the HTTP JSON response from the previous run book action into a human-readable HTML-based format and presents the output in the standard SL1 run book automation output. You should add this action after an HTTP request run book action in the associated automation policy. For more information, see Configuring Network Request Run Book Actions.
-
Datacenter Automation: Format Output as HTML. Formats the command-list execution output into a human-readable HTML-based format and presents the output in the standard SL1 run book automation output. You should add this action after the command execution action in the associated automation policy.
-
Datacenter: Automation Format Output for ServiceNow Non-Scoped. Formats the command-list execution output into a dictionary for ServiceNow to accept for a non-scoped integration. You should add this action after the command execution action in the associated automation policy.
This action is intended to be used with the "Datacenter Automations: Update ServiceNow Incident" run book action.
-
Datacenter Automation: Format Output for ServiceNow Scoped. Formats the command-list execution output into a dictionary for ServiceNow to accept for a scoped integration. This action should come after the command execution action in the associated automation policy.
This action is intended to be used with the "Datacenter Automations: Update ServiceNow Incident" run book action.
-
Datacenter Automations: Update ServiceNow Incident. Updates a ServiceNow incident with enrichment data collected by an enrichment automation action.
This PowerPack also includes the following run book actions:
-
Enrichment: Util: Collect Enrichment Data. Executes the list of commands provided by the previous action and sends the output to the next run book action in the sequence of actions.
-
Enrichment: Util: Format Command Output as HTML. Formats the output of the "Enrichment: Util: Collect Enrichment Data" run book action in HTML format.
-
Enrichment: Util: Load Work Instructions. If the library of work instructions included with the PowerPack contains a set of instructions for the event policy that triggered the event, the run book action will output that set of work instructions.
The following configurations are not supported by this PowerPack:
-
Customer-created run book actions that build command lists to be executed by the "Enrichment: Util: Collect Enrichment Data" run book action are not supported without prior authorization from ScienceLogic.
-
Modifications of any kind to the code supplied in this PowerPack are not supported without prior authorization from ScienceLogic.
For more information about how to use the "Enrichment: Util" run book actions with a run book automation, see Creating and Customizing Run Book Automation Policies.
Sending Enrichment Output to a ServiceNow Integration
The "Automation Utilities: Integrate Automations with SNOW Scoped" run book automation policy updates the run book actions for a specified PowerPack so that PowerPack sends enrichment output to a ServiceNow integration.
This release includes the following event policy and run book action policies to support this automation policy:
- "Automation Utilities: Request to Migrate Datacenter Advanced Enrichment Policies to ServiceNow" event policy
- "Automation Utilities: Change Enrichment Formatting to SN Scoped" run book action policy
- "Automation Utilities: Connect Enrichment Automations to SN" run book action policy
This automation policy modifies the policies in the target Automation PowerPack in the following ways:
-
In all run book automation policies in the target PowerPack, this policy uses "Automation Utilities: Change Enrichment Formatting to SN Scoped" run book action to replace all instances of the "Datacenter Automation: Format Output as HTML" run book action with the "Datacenter Automation: Format Output for ServiceNow Scoped" run book action. This run book action prepares the output to be used in the enrichment of a ServiceNow incident.
-
In all automation policies in the target PowerPack, the "Automation Utilities: Connect Enrichment Automations to SN" run book action replaces instances of the "Enrichment: Util: Load HTML Work Instructions" run book action with the "Datacenter Automations: Update ServiceNow Incident" run book action.
-
For both run book actions, you will need to add the PowerPack ID to the run book action.
Not all Automation PowerPacks have the "Enrichment: Util: Load HTML Work Instructions" action aligned to their automation policies by default. If you would like to send the enrichment information from the target PowerPack to a ServiceNow incident, you can manually align the "Datacenter Automations: Update ServiceNow Incident" run book action to the automation policies in the target PowerPack after running the "Automation Utilities: Integrate Automations with SNOW Scoped" automation policy.
Removing Automation Policies from a PowerPack
The "Automation Utilities: Remove Automation Policies from PowerPack" automation action removes all automation policies from a specific Automation PowerPack. After you have customized an automation policy from an Automation PowerPack, you might want to remove that policy from that PowerPack to prevent your changes from being overwritten if you update the PowerPack later on that SL1 system.
This release includes the following event policy and run book action policy to support this automation policy:
-
"Automation Utilities: Request to Remove Datacenter Advanced Enrichment Policies from PowerPack" event policy
-
"Automation Utilities: Remove Automation Policies from PowerPack" run book action policy
The following topics cover how to configure these automation policies.
Adding the PowerPack Global ID ("guid") to the Run Book Action
To use these automation policies, you will need to locate the global ID ("guid") of the Automation PowerPack you want to update. You then add the "guid" to the run book actions used by the automation policies so that SL1 knows which PowerPack to update.
These instructions are for both of the following run book automation policies:
- Automation Utilities: Integrate Automations with SNOW Scoped
- Automation Utilities: Remove Automation Policies from PowerPack
To locate and add the PowerPack ID to the run book actions:
-
In SL1, go to the API Browser page (System > Tools > API Browser).
-
Update the URI field so it displays /api/powerpack, and then press Enter. A list of the installed PowerPacks appears.
-
Search for the PowerPack you want to update and click the "URI" value for that PowerPack. The detail page for that PowerPack appears:
-
Copy the value that displays in the "guid" row.
-
Go to the Actions page (Registry > Run Book > Actions) and open the corresponding run book action or actions for that automation policy. The Action Editor modal appears:
-
Paste the "guid" value from step 4 into the "powerpack_guid": "%Y", parameter in the Input Parameters section, replacing the %Y with the "guid" value.
For example: "powerpack_guid": "246E715AA03BFAE7C52D1230F3A1CB99",
Other than modifying the target PowerPack "guid", you should not customize the run book actions in the "Datacenter Automation Utilities" PowerPack.
-
Click and continue with the next procedure to test the automation policy.
Triggering the Automation Policy
If you want to test the configuration of an automation policy, you can use the SL1API Browser page to create a test API event based on that automation policy. You will need the device ID (DID) for one of your existing devices to use as the target device for the automation policy. The device ID displays in the ID column on the Devices page.
To trigger an automation policy:
-
In SL1, go to the Automation page (Registry > Run Book > Automation) and open the run book automation policy that you want to run. The Automation Policy Editor page appears:
-
In the Aligned Events section, make a note of the aligned event. In this example, the aligned event is "Automation Utilities: Request to Remove Datacenter Advanced Enrichment Policies from PowerPack".
-
Go to the Event Policies page (Events > Event Policies) and open the event policy from step 2.
-
On the tab, copy the value from the Match String field:
-
Next, you will POST an alert with the event’s Match String to kick off the automation. Go to the API Browser page (System > Tools > API Browser) and update the URI field so it displays /api/alert.
-
Scroll down to the Actions section on the right and click . A Data modal appears.
-
Paste the Match String from step 4 into the "message" parameter.
For example: "message": "Request to Remove Datacenter Advanced Enrichment Policies from PowerPack",
-
Type /api/device/<target_device_id> in the "aligned_resource" field, where <target_device_id> is the device ID for the target device. The device ID displays in the ID column on the Devices page.
For example: "aligned_resource": "/api/device/1"
-
Click to kick off the automation.
-
You can view the event generated by the automation on the Events page (
) or the Classic Events page (Events > Classic Events). -
If a wrench icon (
) appears in the Automated Actions column on the Events page, you can click the Actions button (
) and select View Automation Actions to see more information about the automation that just ran. The Event Actions Log modal appears for that event:
Creating and Customizing Run Book Automation Policies
Before you create an automation policy using the run book actions in this PowerPack or one of the "Datacenter Advanced Enrichment" or "Automation Policies" PowerPacks, you will need to make the following decisions:
- Which set of commands you want to run on a monitored device when an event occurs. There are multiple run book actions in this PowerPack or one of the "Datacenter Advanced Enrichment" or "Automation Policies" PowerPacks that build a list of commands to execute on the monitored device; each run book action builds a different list of commands. This set of run book actions includes all actions that do not have the prefix "Enrichment: Util:".
- What event criteria you want to use to determine when the run book actions will trigger, or the set of rules that an event must match before the automation is executed. This can include matching only specific event policies, event severity, associated devices, and so on. For a description of all the options that are available in automation policies, see the
- Where the output of the run book actions will be viewed by a user. The output is always available in the Event Actions Log modal accessed through the Events page () or the Event Console (Events > Classic Events). Optionally, you can include an additional run book action in your automation policy to send the output of the automation to an additional location. Typically, the additional location is the ticket that was generated for the event in your ticketing system. If you want to configure an automation policy that sends the output of the run book actions to a ticketing system, you must create or have access to the following additional content in SL1:
- A process, either automated or manual, where SL1 events are associated with tickets. Examples of this process include:
- A user clicking the life ring icon (
) on the Tickets page to create a ticket in the SL1 ticketing system. - If your system has been configured so that the Events page () or the Event Console (Events > Classic Events) integrates with an external ticketing system, a user clicking the Actions button () and selecting Create Ticket, or clicking the life ring icon () to request a ticket in your external ticketing system.
- An run book automation policy that is configured to automatically create tickets for events, either in SL1 or an external ticketing system.
- A run book action that sends the output from the previous run book action to the ticketing system. This action should specify that the ticket associated with the triggering event will be updated with this information.
To create or customize a run book automation policy:
-
Go to the Automation Policy Manager page (Registry > Run Book > Automation).
-
Click the button to create an automation policy, or search for an existing automation policy that you want to edit and click the wrench icon (
) for that policy . The Automation Policy Editor page appears.
- Complete the following fields as needed:
-
Policy Name. Type a new name for the automation policy to avoid overwriting the default policy.
-
Policy Type. Select whether the automation policy will match events that are active, match when events are cleared, or run on a scheduled basis. Typically, you would select Active Events in this field.
-
Policy State. Specifies whether the policy will be evaluated against the events in the system. If you want this policy to begin matching events immediately, select Enabled.
-
Policy Priority. Specifies whether the policy is high-priority or default priority. These options determine how the policy is queued.
-
Organization. Select the organization that will use this policy. You must use System for the organization for all policies in this PowerPack. The automation policy will execute for all devices regardless of their specific organization.
-
Aligned Actions (bottom right). To create a valid automation policy that uses the run book actions in this PowerPack or one of the "Datacenter Advanced Enrichment" or "Automation Policy" PowerPacks, you must configure the Aligned Actions field on this page to include multiple actions in a specific sequence. To add an action to the Aligned Actions field, select the action in the Available Actions field and click the right arrow (>>). To re-order the actions in the Aligned Actions field, select an action and use the up arrow or down arrow buttons to change that action's position in the sequence.
If you are not configuring the automation policy to send the output of the run book actions to a ticketing system, if users will view the output in the Event Actions Log modal accessed through the Events page (
) or the Event Console (Events > Classic Events), the automation must include four actions in the following sequence:
- A run book action from this PowerPack or one of the "Datacenter Advanced Enrichment" or "Automation Policy" PowerPacks that builds a list of commands to execute on the monitored device. This set of actions includes all actions in the PowerPack that do not have the prefix "Enrichment: Util:".
- The "Enrichment: Util: Collect Enrichment Data" run book action. This action executes the list of commands provided by the previous action and sends the output to the next run book action in the sequence of actions.
- The "Datacenter Automation: Format Output as HTML" run book action. This action formats the output of the "Enrichment: Util: Collect Enrichment Data" run book action in HTML format. This formatting action is included in this PowerPack.
- The "Enrichment: Util: Load HTML Work Instructions" run book action. If the library of work instructions included with the PowerPack contains a set of instructions for the event policy that triggered the event, this run book action will output that set of work instructions to HTML.
- A run book action from this PowerPack or one of the "Datacenter Advanced Enrichment " PowerPacks that builds a list of commands to execute on the monitored device. This set of actions includes all actions in the PowerPack that do not have the prefix "Enrichment: Util".
- The "Enrichment: Util: Collect Enrichment Data" run book action. This action executes the list of commands provided by the previous action and sends the output to the next run book action in the sequence of actions.
- The "Enrichment: Util: Format Command Output as HTML" run book action, which formats the output of the "Enrichment: Util: Collect Enrichment Data" run book action in HTML format.
- A run book action that performs a request to add the output of the previous action as a work note in your ticketing system. This run book action is not supplied in the "Datacenter Automation Utilities" PowerPack. See the top of this section for more information about the requirements for this action.
- The "Enrichment: Util: Load Work Instructions" run book action. If the library of work instructions included with the PowerPack contains a set of instructions for the event policy that triggered the event, the run book action will output that set of work instructions. Select the HTML or Plaintext action, depending on the format accepted by your ticketing system.
- A run book action that performs a request to add the output of the previous action as a work note in your ticketing system. This should be the same run book action you added in the 4th position in the sequence of run book actions. This run book action is not supplied in the "Datacenter Automation Utilities" PowerPack. See the top of this section for more information about the requirements for this action.
If you are configuring the automation policy to send the output of the run book actions to a ticketing system, the automation must include six actions in a specific sequence:
- Optionally, supply values in the other fields on this page to refine when the automation will trigger. If you are configuring the automation policy to send the output of the run book actions to a ticketing system, you should ensure that the process for associating a ticket with the SL1 event occurs before this automation policy triggers. Typically, you would use the "and ticket IS created" or "and external ticket IS created" options in the Criteria Logic fields to do this.
- Click for a new policy, or click if you are customizing an existing policy. If you modify one of the included automation policies and save it with the original name, any customizations you made to that policy will be overwritten when you upgrade the PowerPack.
After you have configured one or more automation policies that use the run book actions in this PowerPack, you must configure credentials for the run book actions to use. See the Configuring Device Credentials chapter for instructions on how to do this.