Automation Policies

This section describes the automation policies found on the Automation Policy Manager page (Registry > Run Book > Automation).

Use the following menu options to navigate the SL1 user interface:

To view a pop-out list of menu options, click the menu icon ().
To view a page containing all of the menu options, click the Advanced menu icon ().

What is an Automation Policy?

An automation policy defines the combination of event conditions that can trigger an automatic action.

When the criteria in an automation policy is met, one or more actions are executed. Each action is defined in an action policy. Action policies are described in detail in the section on Action Policies.

NOTE: When an automation policy executes actions, the time stamps for the actions will use the time zone defined in the System > Settings > Behavior page, in the System Timezone field. However, "Send an Email Notification" actions will use the time zone associated with each recipient's account, as defined in the Account Preferences page for each recipient. For more information on the Account Preferences, see Account Preferences.

Automation policies can describe the following criteria. One or more of these criteria must be met before an action is executed.

At least one of the specified events must have occurred.
Event(s) must have occurred on at least one of the specified devices.
Event(s) must have specified severity (critical, major, minor, notice, or healthy).
Event(s) must have specified status (event is not cleared, event is now acknowledged, ticket is not created for event).
Specified amount of time must elapse after the event occurs and before the other criteria are evaluated by SL1.
Specified text must appear in the event message.

If an automation policy has a Policy Type of Scheduled, then an Automation Schedule from the Automation Schedule Manager page (Registry > Run Book > Schedules) is required instead of an event condition to trigger the automation. For more information, see Scheduling an Automation Policy.

You can enable user-initiated automations that let a user manually trigger an automation policy and its aligned action policies in the SL1 user interface. For more information, see User-initiated Automations.

Before You Begin

Before you define automation policies, you should consider:

The types of automatic actions that SL1 can trigger in response to an automation policy. The choices are:

Send an email message to a pre-defined list of users and/or external contacts.
Send an SNMP trap from SL1 to an external device.
Create a new ticket (using ticket templates defined in the Ticket Templates page [Registry > Ticketing > Templates]).
Update an existing ticket. An action policy can change the status and/or severity of an existing ticket and/or add a note to an existing ticket. For this action policy to trigger successfully, a ticket must be associated with the event that triggered the action.
Write an SNMP value to an existing SNMP object on an external device.
Query a database.
Run a custom Python script, called a snippet.
Send an SMS Message to a Topic ARN (Amazon Resouce Name). All subscribers to the Topic ARN will receive the message.

The event conditions that are most critical to your business or organization.
The event conditions that are best suited to an automatic response (instead of a manual response).

Viewing the List of Automation Policies

The Automation Policy Manager page (Registry > Run Book > Automation) displays a list of all existing automation policies.

NOTE: Users of type "user" can view only automation policies that are aligned with the same organization(s) to which the user is aligned. Users of type "administrator" can view all automation policies.

To sort the list of automation policies, click on a column heading. The list will be sorted by the column value, in ascending order. To sort by descending order, click the column heading again. The Last Edited column sorts by descending order on the first click; to sort by ascending order, click the column heading again.

To view the list of automation policies:

Navigate to the Automation Policy Manager page (Registry > Run Book > Automation).
The Automation Policy Manager page displays the following about each automation policy:

Automation Policy Name. Name of the automation policy.
ID. Unique numeric identifier, automatically assigned by SL1 to each automation policy.
Policy State. Specifies whether the policy can be executed (enabled) or cannot be executed (disabled).
Policy Priority. Specifies whether this policy is high-priority or default priority. These options determine how the policy is queued.
Organization. Organization associated with the automation policy.
Devices. Number of devices included in the criteria for the automation policy.
Events. Number of events included in the criteria for the automation policy.
Actions. Number of action policies that will be executed by the automation policy.
Edited By. User who created or last edited the automation policy.
Last Edited. Date and time the automation policy was created or last edited.

Filtering the List of Automation Policies

The Automation Policy Manager page includes nine filters. You can filter the list of automation policies by one or more of the following parameters: automation policy name, automation ID, policy state, policy priority, organization, number of devices included in the automation policy, number of events included in the automation policy, number of actions executed by the automation policy, user who created or last edited the policy, and date the policy was created or last edited. You can specify one or more parameters to filter the list of automation policies. Only automation policies that meet all of the filter criteria will be displayed in the Action Policy Manager page.

The list of automation policies is dynamically updated as you select each filter. For each filter except Last Edited, you must enter text to match against. SL1 will search for automation policies that match the text, including partial matches. Text matches are not case-sensitive. You can use special characters in each filter.

To filter the list of automation policies:

Navigate to the Automation Policy Manager page (Registry > Run Book > Automation).
The Automation Policy Manager page displays a list of automation policies. To sort the list, you can enter a value in one or more of the following headings:

Automation Policy Name. Name of the automation policy. You can enter text to match, including special characters, and the Automation Policy Manager page will display only automation policies that have a matching policy name.
ID. Unique numeric identifier, automatically assigned by SL1 to each automation policy. You can enter numbers to match, including special characters, and the Automation Policy Manager page will display only automation policies that have a matching automation ID.
Policy State. Specifies whether the policy can be executed (enabled) or cannot be executed (disabled). You can enter text to match, including special characters, and the Automation Policy Manager page will display only automation policies that have a matching state.
Policy Priority. Specifies whether the policy is high-priority or default priority. These options determine how the policy is queued. You can enter text to match, including special characters, and the Automation Policy Manager page will display only automation policies that have a matching priority.
Organization. Organization associated with the automation policy. You can enter text to match, including special characters, and the Automation Policy Manager page will display only automation policies that have a matching organization.
Devices. Number of devices included in the criteria for the automation policy. You can enter numbers to match, including special characters, and the Automation Policy Manager page will display only automation policies that have a matching number of aligned devices.
Events. Number of events included in the criteria for the automation policy. You can enter numbers to match, including special characters, and the Automation Policy Manager page will display only automation policies that have a matching number of aligned events.
Actions. Number of action policies that will be executed by the automation policy. You can enter numbers to match, including special characters, and the Automation Policy Manager page will display only automation policies that have a matching number of aligned action policies.
Edited By. The user who last edited the automation policy. You can enter text to match, including special characters, and the Automation Policy Manager page will display only automation policies that have a matching username in the Edited By field.
Last Edited. Only those automation policies that match all of the previously selected fields and have the specified creation date or last-edited date will be displayed. The choices are:

All. Display all automation policies that match the other filters.
Last Minute. Display only automation policies that have been created within the last minute.
Last Hour. Display only automation policies that have been created within the last hour.
Last Day. Display only automation policies that have been created within the last day.
Last Week. Display only automation policies that have been created within the last week.
Last Month. Display only automation policies that have been created within the last month.
Last Year. Display only automation policies that have been created within the last year.

Special Characters

When filtering a list in a registry page, you can include the following special characters to search each field except those that display date and time:

NOTE: When searching for a string, SL1 will match substrings by default, even if you do not include any special characters. For example, searching for "hel" will match both "hello" and "helicopter". When searching for a numeric value, SL1 will not match a substring unless you use a special character.

Special Character	Description	Example
, (comma)	(For strings or numeric values) Specifies an OR operation.	"dell,micro" would match all values that contain the string "dell" OR the string "micro".
& (ampersand	(For strings or numeric values) Specifies an AND operation.	"dell&micro" would match all values that contain both the string "dell" AND the string "micro", in any order.
! (exclamation point)	(For strings or numeric values) Specifies a NOT operation. You can also use the "!" character in combination with the arithmetic special characters (min-max, >, <, >=, <=, =) described below.	"!dell" would match all values that do not contain the string "dell".
* (asterisk)	(For strings or numeric values) Specifies a "match-zero-or-more" operation. For a string, matches any string that matches the text before and after the asterisk. For a numeral, matches any numeral that contains the text.	"heler" would match "helpers" and "helicopter" but not "hello". "325" would match "325", "32561", and "325000". "*000" would match "1000", "25000", and "10500000".
? (question mark)	(For strings or numeric values) Specifies a "match any one character" operation.	"l?ver" would match the strings "oliver", "levers", and "liver", but not "believers". "135?" would match the numbers "1350", "1354", and "1359", but not "13502".
^ (caret)	(For strings only) Specifies a "match the beginning" operation. Matches any string that begins with the specified string.	"^sci" would match "scientific" and "sciencelogic", but not "conscious".
$ (dollar)	(For strings only) Specifies "match the ending". Matches any string that ends with the specified string. You can use both ^ and $ if you want to match an entire string. For example, "^tern$" would match the strings "tern" or "Tern" or "TERN"; it would not match the strings "terne" or "cistern".	"ter$" would match the string "renter" but not the string "terrific".
min-max	(For numeric values only) Matches any value between the specified minimum value and the maximum value, including the minimum and the maximum.	"1-5 "would match 1, 2, 3, 4, and 5.
- (dash)	(For numeric values only) A "half open" range. Matches values including the specified minimum and greater, or including the specified maximum and lesser.	"1-" matches 1 and greater, so it would match 1, 2, 6, 345, etc. "-5" matches 5 and less, so it would match 5, 3, 1, 0, etc.
> (greater than)	(For numeric values only) Matches any value greater than the specified value.	">7" would match all values greater than 7.
< (less than)	(For numeric values only) Matches any value less than the specified value.	"<12" would match all values less than 12.
>= (greater than or equal to)	(For numeric values only) Matches any value that is equal to or greater than the specified value.	">=7" would match all values 7 and greater.
<= (less than or equal to)	(For numeric values only) Matches any value that is equal to or less than the specified value.	"<=12" would match all values 12 and less.
= (equal)	(For numeric values only) Matches a value that is equal to the the specified value. You can also use this special character to match a negative value, as demonstrated in the example.	"=-5 " would match "-5" instead of being evaluated as the "half open range" as described above.

Creating an Automation Policy

An automation policy defines the event conditions that must be met before SL1 will trigger an automatic action (defined in an action policy).

You can also create a "user initiated" automation policy that lets a user trigger an automation action (from an action policy) on an as needed, ad hoc basis. A user-initiated automation does not require that the event-based logic in the Criteria Logic section matches to True in the automation policy, as the user action supersedes that criteria. For more information, see User-initiated Automations.

In addition, if an automation policy has a Policy Type of Scheduled, then an Automation Schedule from the Automation Schedule Manager page (Registry > Run Book > Schedules) is required instead of an event condition to trigger the automation. For more information, see Scheduling an Automation Policy.

To create an automation policy:

Navigate to the Automation Policy Manager page (Registry > Run Book > Automation).
Click the Create button. The Automation Policy Editor page appears:

In the Automation Policy Editor page, supply a value in each of the following fields:

Policy Name. Name of the automation policy.
Policy Type. Specifies whether the automation policy will search for cleared events or active events, or if this will be a scheduled automation policy. You choices are:

Active Events. The automation policy will search active events to find events that meet the criteria.
Cleared Events. The automation policy will search cleared events to find events that meet the criteria.
Scheduled. The automation policy will execute as specified by a selected Automation Schedule. The Automation Policy will not search events to match criteria. For more information, see Scheduling an Automation Policy.
User Initiated. The Automation policy lets the user execute an "ad hoc" automation on an event from the Events page, an Event Investigator page, or a Service Investigator page. For more information, see User-initiated Automations. If you select User Initiated, the following fields are hidden: Policy Priority, Criteria Logic, Match Logic, Match Syntax, Repeat Time, and Trigger on Child Rollup.
Active Events/User Initiated. The automation policy enables all of the features of the "Active Events" and the "User Initiated" Policy Types. As a result, this automation policy can be triggered by active events that meet the criteria in the policy, or a user can manually trigger the automation.

Policy State. Specifies whether the policy can be executed (enabled) or cannot be executed (disabled).

Policy Priority. Specifies whether this policy is high priority or default priority. Options are:

Default. This policy is placed into a default queue. SL1 includes multiple worker tasks that constantly check this queue and execute policies in this queue. If there are no policies in the default queue, the worker tasks execute policies in the high-priority queue.
High. This policy is placed into the high-priority queue. SL1 includes multiple worker tasks that constantly check this queue and execute the policies. For details on configuring the number of worker tasks for high-priority policies, contact ScienceLogic Customer Support. If there are no policies in the high-priority queue, the worker tasks execute policies in the Default queue.

Organization. Organization associated with the automation policy. If you select the System organization, the behavior of the Available Devices and Available Device Groups fields is affected.
Criteria Logic. These fields specify the conditions that must be met before SL1 executes the action specified in the automation policy. All conditions must be met for at least one of the selected events on one of the selected devices.

Severity Operator. Used in conjunction with the Severity field. Choices are:

Severity >=. Severity is greater than or equal to.
Severity =. Severity must be equal to.

Severity. Event must have the specified severity or have a severity greater than or equal to the specified severity. The choices are:

Critical
Major
Minor
Notice
Healthy

Elapsed time. The length of time that must elapse after the event occurs but before SL1 evaluates the other criteria in the automation policy. The choices are intervals of time ranging from "no time has elapsed" to "1 month has elapsed", and you must then specify whether the elapsed time is counted "since the first occurrence" or "since the activation time". You might use this field to allow users to manually perform actions before the automation actions are executed.
Since. Specifies the ScienceLogic event that is applied to Elapsed time. The choices are:

since the first occurrence
since the activation time (when an event became active). For more information, see the section on event states.

Status. Event must have the specified status. The choices are:

and event is NOT cleared
and event is NOT acknowledged
and ticket is NOT created
and event IS acknowledged
and ticket IS created
and external ticket IS requested
and external ticket IS created

The Status options "and external ticket IS requested" and "and external ticket IS created" require that you select Create/View External Ticket for the global setting Event Console Ticket Life Ring Button Behavior in the Behavior Settings page (System > Settings > Behavior). You can use this Status to trigger a custom run book action to create a ticket on the external system or perform actions after a ticket is created on the external system. For more information on system settings, see global settings.

The Status option "and ticket IS created" requires that you select Create/View EM7 Ticket for the global setting Event Console Ticket Life Ring Button Behavior in the Behavior Settings page (System > Settings > Behavior). You can use this Status to trigger a custom run book action that performs actions after a ticket is created on the SL1. For more information on system settings, see global settings.

The Elapsed Time and Status fields do not appear if you selected Cleared Events in the Policy Type field.

Time/Schedule. Specifies the timespan during which the Automation Policy can execute the aligned actions. The choices are:

and all times are valid. The Automation Policy can execute the aligned actions when all the criteria are met. There is no schedule associated with the criteria.
and the following schedule is active. The Automation Policy can execute the aligned actions during the timespan specified in the selected schedule.
and the following schedule is NOT active. The Automation Policy can execute the aligned actions during any time except the timespan specified in the selected schedule. You would use this option in cases where you want to restrict event-driven automation from running during a particular time.

Schedule. If in the Time/Schedule field you specified "and the following schedule is active" or "and the following schedule is NOT active", select a schedule in this field. Note that ad hoc automation schedules, which specify a single point in time, will not be shown in this field.

Match Logic. Specifies whether to process the Match Syntax field as a regular expression or a simple text match. This field is optional. However, if you enter a value in the Match Syntax field, you must also select a value in this field.
Match Syntax. An optional string to further filter events. For SL1 to execute the actions specified in the policy, the event message must match the text or regular expression defined in this field. For example, if you want to be notified only when an event occurs on a specific sub-entity (like an interface or a file system), you can specify a text match or regular expression that will match that sub-entity in this field. Can be any combination of alpha-numeric characters, up to 48-characters in length. SL1's expression matching is case-sensitive.
Repeat Time. The frequency at which SL1 should execute the automation policy while the conditions are still met. The choices range from "every 30 seconds until satisfied" to "every 2 hours until satisfied", or "only once". The Repeat Time field does not appear if you selected Cleared Events in the Policy Type field.
Align With. Specifies whether to align this automation policy with one or more devices, one or more device groups, or one or more organizations.

Devices. The Available Devices field will appear below, where you can select devices to associate with the automation policy.
Device Groups. The Available Device Groups field will appear below, where you can select device groups to associate with the automation policy.
Policy Organization. The Available Devices in Organization field will appear below, where you can select one or more devices to associate with the automation policy. The list of devices comprises all devices in the organization specified in the Organization field.
IT Services. The Available IT Services field will appear below, where you can select one or more IT Services to associate with the automation policy.

Trigger on Child Rollup. Affects events that are rolled up, either using event correlation or event masks. If selected, all events in a suppression group can trigger the automation policy. If not selected, only a single event in a suppression group can trigger the automation policy.
Include events for entities other than devices (organizations, assets, etc.). If you select this checkbox, the automation policy can match events that are not associated with a device. The automation policy will match events that are not associated with a device only if you do not select specific devices or device groups from the Available Devices, Available Device Groups, Available Devices in Organization, or Available IT Services field.
Available Devices. If you selected Devices in the Align With field, this field displays a list of all devices in SL1. You can select one or more devices in this field. The selected event(s) and event criteria must occur on one of the selected devices before the automation policy will be executed. You can use the field at the top of the Available Devices field to filter the list of devices. If you enter an alpha-numeric string in the field, the Available Devices field will include only devices that match the string.

To select a device, highlight it and click the right-arrow button.
If you do not select any devices, the automation policy automatically evaluates all devices associated with the organization you selected in the Organization field. If you selected System in the Organization field, the automation policy automatically evaluates all devices in SL1. Additionally, if the include events for entities other than devices (organizations, assets, etc.) checkbox is checked, the automation policy will evaluate all events associated with all organizations that are not associated with a device, regardless of the organization selected in the Organization field.
If you select specific devices, the automation policy will evaluate all selected devices. Not selecting specific devices allows an automation policy to evaluate events that are aligned with an entity other than a device.

Aligned Devices. This pane displays a list of all devices aligned with the automation policy. To de-select a device, highlight it and click the left-arrow button.
Available Device Groups. If you selected Device Groups in the Align With field, this field displays a list of all device groups in SL1. You can select one or more device groups in this field. The selected event(s) and event criteria must occur on at least one device in one of the selected device groups before the automation policy will be executed. You can use the field at the top of the Available Device Groups field to filter the list of device groups. If you enter an alpha-numeric string in the field, the Available Device Groups field will include only device groups that match the string.

To select a device group, highlight it and click the right-arrow button.
If you do not select any device groups, the automation policy automatically evaluates all device groups to which you have access. Additionally, if the Include events for entities other than devices (organizations, assets, etc.) checkbox is checked, the automation policy will evaluate all events associated with all organizations that are not associated with a device, regardless of the organization selected in the Organization field.
If you select specific device groups, the automation policy will evaluate all selected device groups. Not selecting specific device groups allows an automation policy to evaluate events that are aligned with an entity other than a device.

Aligned Device Groups. This pane displays a list of all device groups aligned with this automation policy. To de-select a device group, highlight it and click the left-arrow button. Note that selecting a device group aligns all devices that are part of the device group with the automation policy.
Available Devices in Organization. If you selected Policy Organization in the Align With field, this field displays only devices from the organization selected in the Organization field. You can select one or more devices in this field. The selected event(s) and event criteria must occur on one selected device before the automation policy will be executed. You can use the field at the top of the Available Devices in Organization field to filter the list of devices. If you enter an alpha-numeric string in the field, the Available Devices in Organization field will include only devices that match the string.

To select a device, highlight it and click the right-arrow button.
If you do not select any devices, the automation policy automatically evaluates all devices associated with the organization you selected in the Organization field. Additionally, if the Include events for entities other than devices (organizations, assets, etc.) checkbox is checked, the automation policy will evaluate all events associated with the organization specified in the Organization field that are not associated with a device.
If you select specific devices, the automation policy will evaluate all selected devices. Not selecting specific devices allows an automation policy to evaluate events that are aligned with an entity other than a device.

Aligned Devices. This pane displays a list of all devices aligned with this automation policy. To de-select a device, highlight it and click the left-arrow button.
Available IT Services. If you selected IT Services in the Align With field, this field displays a list of all IT Services in SL1. You can select one or more IT Services in this field. The selected event(s) and event criteria must occur for one of the selected IT Services before the automation policy will be executed. You can use the field at the top of the Available IT Services field to filter the list of IT service policies. If you enter an alpha-numeric string in the field, the Available IT Services field will include only IT service policies that match the string.

To select an IT Service, highlight it and click the right-arrow button.
If you do not select any IT Services, the automation policy automatically evaluates all IT Services associated with the organization you selected in the Organization field. If you selected System in the Organization field, the automation policy automatically evaluates all IT Services in SL1.
If you select specific IT Services, the automation policy will evaluate all selected devices. Not selecting specific IT Services allows an automation policy to evaluate events that are aligned with an entity other than an IT Service.

Aligned IT Services. This pane displays a list of all IT Services aligned with this automation policy. To de-select an IT Service, highlight it and click the left-arrow button.
Available Events. Displays a list of all defined events in SL1. You can select one or more events in this field. One of the selected events and event criteria must occur on one selected device before the automation policy will be executed. To select an event, highlight it and click the right-arrow button. This pane also displays the ID number for each aligned event policy to ensure you select the relevant policy. You can use the field at the top of the Available Events field to filter the list of events. If you enter an alpha-numeric string in the field, the Available Events field will include only events that match the string.

Aligned Events. This pane displays a list of all events aligned with this automation policy, along with the ID number of the aligned event policy. To de-select an event, highlight it and click the left-arrow button.

If a triggering event (that is, an event specified in the Aligned Events field is not aligned with a device (but is instead aligned with an organization), and you have also selected one or more Aligned Actions that must be executed on a Data Collector, SL1 will 1) Not execute the action policy; 2) Create a log entry in the audit log for the organization aligned with the triggering event, noting that the criteria in the automation policy were met, but that the action policy was not executed. This does not apply to Action Policies created on an All-In-One Appliance.

Available Actions. Displays a list of all action policies in SL1. (Action policies are defined in Registry > Run Book > Actions.) You can select one or more action policies in this field. If the selected event(s) and event criteria occur on the selected devices or for the selected IT Services, the selected action policies will be executed. To select an action policy, highlight it and click the right arrow-button. You can use the field at the top of the Available Actions field to filter the list of action policies. If you enter an alpha-numeric string in the field, the Available Actions field will include only action policies that match the string.

Aligned Actions. This pane displays a list of all action policies aligned with this automation policy.

To de-select an action policy, highlight it and click the left-arrow button.
To change the order in which one or more action policies are executed, highlight the action policy and use the up-arrow or down-arrow to move the policy within the list.

If you selected multiple action policies in the automation policy, the action policies will be executed in the order specified in the Aligned Actions field. To change the order of one or more action policies, highlight the action policy and use the up-arrow or down-arrow to move the policy within the list.

Save. Saves a new automation policy or saves changes to an existing automation policy.
Save As. If you supply a new value in the Policy Name field, saves the current automation policy, including any edits, as a new policy with a new name.

Click the Save button to save the new automation policy or save changes to an existing automation policy.

User-initiated Automations

You can run or create a "user-initiated" automation policy that lets a user trigger an automation action (from an action policy) on an as-needed, "ad hoc" basis. A user-initiated automation does not require that the event-based logic in the Criteria Logic section matches to True in the automation policy as the user action supersedes that criteria.

PowerPacks that Contain User-initiated Automations

The Datacenter Automation Utilities PowerPack is required for all Automation PowerPacks.

The Datacenter Advanced Enrichment Actions PowerPack is required for Cisco Automation PowerPacks.

Follow the installation and configuration instructions in the release notes for the PowerPacks containing the automations ou want to use. You must meet all prerequisites for each PowerPack before the automations from that PowerPack will be available in the Tools pane in SL1.

The following is a partial list of the PowerPacks that contain user-initiated automation policies:

Cisco IOS Automation Policies PowerPack version 102 or later
Cisco IOS-XE Automation Policies PowerPack version 102 or later
Cisco IOS-XR Automation Policies PowerPack version 102 or later
Cisco Networking Automation Policies PowerPack version 102 or later
Linux SSH Automation Policies User-initiated Automation PowerPack
Network Connectivity User-initiated Automation PowerPack
VMware User-initiated Automation PowerPack
Windows PowerShell User-initiated Automation PowerPack

For a complete list of PowerPacks containing user-initiated automation policies, see the PowerPacks page of the ScienceLogic Support Site.

To run user-initiated automations with a device group, the device group must use a static list of devices, not a dynamic list of devices.

Locating a User-initiated Automation

You can run a user-initiated automation from the Run Book Actions section of the Tools pane. The Tools pane is available on the Event Drawer for an event on the Events page, the Event Investigator page for an event, and the Service Investigator page for a service.

A Tools pane with a Run Book Actions section is available in the following locations in SL1:

The Event Drawer for an event on the Events page. The event must be aligned with a device to enable the Event Drawer. To open the Event Drawer, click the down arrow icon () for that event:

If needed, click the Select Columns icon () and select Automated Actions to add that column to the Events page. This column lists the number of automated actions for each event, and you can click the number to open the Event Actions Log window.

The Event Investigator page for an event. Select the event from the Events page to view the Event Investigator page:

To see if an event was associated with an automation, click the Actions button () from the Events page and select View Automation Actions. The Event Actions Log window appears, with a list of all previously run automations. In the classic user interface, you can open the Event Actions Log window from the Events Console by clicking the View Notification Log icon () when the value in the Notify column increases.

The Service Investigator page for a service. Select the service from the Business Services page to view the Service Investigator page, and then scroll down to the Events tab. To open the Event Drawer for an event for that service, click the down arrow icon ():

Running a User-initiated Automation

In most situations, you would run a user-initiated automation in response to an event that just occurred. If you have Automation PowerPacks installed on your SL1 system, the Event Actions Log window for that event might contain diagnostic information from other automations that have already run, including information that helps you determine which user-initiated automation you should run next to address the cause of the event.

To run a user-initiated automation:

On the Events page, locate the event.
Click the Actions button () for the event and select View Automation Actions. The Event Actions Log window appears:
On the Event Actions Log window, review any existing automations that have already run, along with any diagnostic information or instructions that might appear for the event.
Go to the Tools pane on the Events page, on the Event Investigator page, or on the Service Investigator page Events tab.
From the Run Book Actions section on the Tools pane, click to run the relevant user-initiated automation:
After the action completes, click the View Logs link if needed. The Event Actions Log window displays updated information about the user-initiated automation.

Creating a User-initiated Automation

For an automation action to be visible on the Tools pane, the following two things must be true:

Organization. The event must occur for the aligned organization specified in the automation policy, or the automation policy is linked to the System organization.
Aligned Event. The event must match one of the aligned events specified in the automation policy.

All user-initiated run book automations are shown on the Tools pane, even if they are disabled.

To create a user-initiated automation:

On the Automation Policy Manager page (Registry > Run Book > Automation, click Create. The Automation Policy Editor window appears.
On the Automation Policy Editor page, complete the following fields:

Policy Name. Name of the automation policy.
Policy Type. Specifies whether the automation policy will search for cleared events or active events, or if this will be a scheduled automation policy. You choices are:

User Initiated. The Automation policy lets the user execute an "ad hoc" automation on an event from the Events page or a service from the Service Investigator page.

If you select User Initiated, the following fields are hidden: Policy Priority, Criteria Logic, Match Logic, Match Syntax, Repeat Time, and Trigger on Child Rollup.
Active Events/User Initiated. The automation policy enables all of the features of the "Active Events" and the "User Initiated" Policy Types. As a result, this automation policy can be triggered by active events that meet the criteria in the policy, or a user can manually trigger the automation.

If you select Active Events/User Initiated, see Creating an Automation Policy for descriptions of the additional fields on the Automation Policy Editor page.

Policy State. Specifies whether the policy can be executed (enabled) or cannot be executed (disabled).

Organization. Organization associated with the automation policy. If you select the System organization, the behavior of the Available Devices and Available Device Groups fields is affected.

Align With. Specifies whether to align this automation policy with one or more devices, one or more device groups, or one or more organizations.

Devices. The Available Devices field will appear below, where you can select devices to associate with the automation policy.
Device Groups. The Available Device Groups field will appear below, where you can select device groups to associate with the automation policy.

To run user-initiated automations with a device group, the device group must use a static list of devices, not a dynamic list of devices.
Policy Organization. The Available Devices in Organization field will appear below, where you can select one or more devices to associate with the automation policy. The list of devices comprises all devices in the organization specified in the Organization field.

Available Devices. If you selected Devices in the Align With field, this field displays a list of all devices in SL1. You can select one or more devices in this field. The selected event(s) and event criteria must occur on one of the selected devices before the automation policy will be executed.

To select a device, select it and click the right-arrow button.
If you do not select any devices, the automation policy automatically evaluates all devices associated with the organization you selected in the Organization field. If you selected System in the Organization field, the automation policy automatically evaluates all devices in SL1.
If you select specific devices, the automation policy will evaluate all selected devices.

Aligned Devices. This pane displays a list of all devices aligned with the automation policy. To de-select a device, select it and click the left-arrow button.
Available Device Groups. If you selected Device Groups in the Align With field, this field displays a list of all device groups in SL1. You can select one or more device groups in this field. The selected event(s) and event criteria must occur on at least one device in one of the selected device groups before the automation policy will be executed.

To select a device group, select it and click the right-arrow button.
If you do not select any device groups, the automation policy automatically evaluates all device groups to which you have access.
If you select specific device groups, the automation policy will evaluate all selected device groups.

Aligned Device Groups. This pane displays a list of all device groups aligned with this automation policy. To de-select a device group, select it and click the left-arrow button.
Available Devices in Organization. If you selected Policy Organization in the Align With field, this field displays only devices from the organization selected in the Organization field. You can select one or more devices in this field. The selected event(s) and event criteria must occur on one selected device before the automation policy will be executed.

To select a device, select it and click the right-arrow button.
If you do not select any devices, the automation policy automatically evaluates all devices associated with the organization you selected in the Organization field.
If you select specific devices, the automation policy will evaluate all selected devices.

Aligned Devices. This pane displays a list of all devices aligned with this automation policy. To de-select a device, select it and click the left-arrow button.

Aligned IT Services. This pane displays a list of all IT Services aligned with this automation policy. To de-select an IT Service, select it and click the left-arrow button.
Available Events. Displays a list of all defined events in SL1. You can select one or more events in this field. One of the selected events and event criteria must occur on one selected device before the automation policy will be executed. To select an event, select it and click the right-arrow button. This pane also displays the ID number for each aligned event policy to ensure you select the relevant policy.

Aligned Events. This pane displays a list of all events aligned with this automation policy, along with the ID number of the aligned event policy. To de-select an event, select it and click the left-arrow button.

Available Actions. Displays a list of all action policies in SL1. (Action policies are defined in Registry > Run Book > Actions.) You can select one or more action policies in this field. If the selected event(s) and event criteria occur on the selected devices or for the selected IT Services, the selected action policies will be executed. To select an action policy, select it and click the right arrow-button.

Aligned Actions. This pane displays a list of all action policies aligned with this automation policy.

To de-select an action policy, select it and click the left-arrow button.
To change the order in which one or more action policies are executed, select the action policy and use the up-arrow or down-arrow to move the policy within the list.

If you selected multiple action policies in the automation policy, the action policies will be executed in the order specified in the Aligned Actions field. To change the order of one or more action policies, select the action policy and use the up-arrow or down-arrow to move the policy within the list.

Save. Saves a new automation policy or saves changes to an existing automation policy.
Save As. If you supply a new value in the Policy Name field, saves the current automation policy, including any edits, as a new policy with a new name.

Click the Save button to save the new automation policy or save changes to an existing automation policy.

Scheduling an Automation Policy

You can use an Automation Schedule to automatically trigger Run Book Automations based on time and day, or to restrict a Run Book Automation from running during certain time windows. The actions are executed according to the schedule, regardless of event status, or you can manually execute a scheduled automation policy at any time.

For example, you can use an automation schedule to:

Run a specific Run Book Automation for a given point in time (such as, tonight at midnight).
Run a specific Run Book Automation at an interval (such as, every day at 6:00 p.m.).
Restrict a Run Book Automation from triggering a support event during normal work hours (such as, 8:00 to 5:00).

Creating an Automation Schedule

You must create an Automation Schedule on the Automation Schedule Manager page before you can use it with an automation policy.

To create a schedule for an automation:

Navigate to the Automation Schedule Manager page (Registry > Run Book > Schedules).

NOTE: After an automation schedule has been associated with an automation policy, you can click the + icon next to the schedule in the Automation Schedule Manager page to expand a list of all automation tasks that are associated with the schedule. A task can be associated with more than one schedule, so if you disable a task, it is disabled for all schedules associated with that task. You align a task with a schedule when you create the scheduled automation policy.

Click the Create button. A new Schedule Editor modal appears.
In the Schedule Editor modal, complete the following fields:

Basic Settings

Schedule Name. Type a name for the schedule.

Visibility. Select the visibility level for the schedule. You can select one of the following:

Private. The schedule is visible only to the owner selected in the Owner field.

Organization. The schedule is visible only to the organization selected in the Organization field.
World. The schedule is visible to all users.

Organization. If Visibility is set to "Organization", select the name of the organization with which this schedule is associated.
Owner. Select the owner of the schedule. The default value is the username of the user who created the schedule.

Time Settings

Start Time. Click in the field and select the date and time you want the schedule to start.
End Time. (Optional) If specifying a time range during which Run Book Automations associated with this schedule will run, or if specifying a time range during which Run Book Automations associated with this schedule will be restricted, select the date and time you want the schedule to end. If you want this automation schedule to be valid for a single point in time, do not enter an End Time.
Time Zone. Select the region or time zone for the scheduled start time. If you want SL1 to automatically adjust for daylight savings time (if applicable), then you must select a named region (such as America/New York) in the Time Zone field. If you select a specific time zone (such as EST) or a specific time offset (such as GMT-5), then SL1 will not automatically adjust for daylight savings time.
All Day. If you want this schedule to be valid for a single day, enter a Start Time and select this checkbox. The End Time selection will be grayed out.
Recurrence. Select whether you want the schedule to occur once or on a recurring basis. You can select one of the following:

None. The schedule occurs only once.
By Interval. The schedule recurs at a specific interval.

If you select By Interval, specify the interval in frequency number, then select the time interval (Minutes, Hours, Days, Weeks, or Months). For example:

If you specify "6 Hours", then the schedule recurs every six hours from the time listed in the Start Time field.
If you specify "10 Days", then the schedule recurs every 10 days from the date listed in the Start Time field.
If you specify "2 Weeks", then the schedule recurs every two weeks, on the same day of the week as the Start Time.
If you specify "3 Months" the ticket recurs every three months, on the same day of the month as the Start Time.

<Dynamic>. The system will offer a dynamic option based on your entries in the fields above. For example, if you have created an automation schedule for date that is a first Monday of the month, your dynamic option would be Every 1st Monday. Use this for recurring Run Book Automations that you want to run on a particular day of the month.

Recur Until. Specifies when the schedule stops recurring. You can select one of the following:

No Limit. The schedule recurs indefinitely until you disable it.
Specified Date. The schedule recurs until a specific date and time. If you select Specified Date, you must select a date and time in the Last Recurrence field.

Last Recurrence. Click in the field and select the date and time you want the schedule to stop recurring.

Click Save to save the new schedule.

This is an example of an automation schedule for a one-time, ad hoc test:

This is an example of an automation schedule for a non-recurrent test within a date range:

Creating an Automation Policy Limited by Schedule

After you create a schedule for the automation on the Automation Schedule Manager page (Registry > Run Book > RunBook Schedules), you can create an event-driven automation policy that is limited to run based on an automation schedule.

To create an event-driven automation policy that is limited to run within an automation schedule:

Navigate to the Automation Policy Manager page (Registry > Run Book > Automation).
Click the Create button. The Automation Policy Editor page appears.

In the Automation Policy Editor page, supply a value in each of the following fields:

Policy Name. Name of the automation policy.
Policy Type. Select Active Events.
Policy State. Specifies whether the policy can be executed (Enabled) or cannot be executed (Disabled).
Organization. Organization associated with the automation policy. If you select the System organization, the behavior of the Available Devices and Available Device Groups fields is affected.

The organization you select must match the organization of the Automation Schedule you specify in the criteria.
Criteria Logic. Specify criteria for the schedule you want to use to limit the automation policy.

Time/Schedule. Specifies the timespan during which the automation policy can execute the aligned actions. The choices for scheduled automations are:

and the following schedule is active. The automation policy can execute the aligned actions during the timespan specified in the selected schedule.
and the following schedule is NOT active. The automation policy can execute the aligned actions during any time except the timespan specified in the selected schedule.

Schedule. Select an available schedule in this field.

Align With. Specifies whether to align this automation policy with one or more devices, one or more device groups, or one or more organizations.

Devices. The Available Devices field will appear below, where you can select devices to associate with the automation policy.
Device Groups. The Available Device Groups field will appear below, where you can select device groups to associate with the automation policy.
Policy Organization. The Available Devices in Organization field will appear below, where you can select one or more devices to associate with the automation policy. The list of devices comprises all devices in the organization specified in the Organization field.

Available Devices. If you selected Devices in the Align With field, this field displays a list of all devices in SL1. You can select one or more devices in this field. The selected event(s) and event criteria must occur on one of the selected devices before the automation policy will be executed.
Aligned Devices. This pane displays a list of all devices aligned with the automation policy. To de-select a device, highlight it and click the left-arrow button.
Aligned Device Groups. This pane displays a list of all device groups aligned with this automation policy. To de-select a device group, highlight it and click the left-arrow button. Note that all devices contained in a device group are aligned with the automation policy when you align a device group.
Available Devices in Organization. If you selected Policy Organization in the Align With field, this field displays only devices from the organization selected in the Organization field. You can select one or more devices in this field. The selected event(s) and event criteria must occur on one selected device before the automation policy will be executed.
Aligned Devices. This pane displays a list of all devices from the specified organization that are aligned with this automation policy. To de-select a device, highlight it and click the left-arrow button.
Available Actions. Displays a list of all action policies in SL1. Action policies are defined in Registry > Run Book > Actions. You can select one or more action policies to run on your schedule. To select an action policy, highlight it and click the right arrow-button.
Aligned Actions. This pane displays a list of all action policies aligned with this automation policy.

To de-select an action policy, highlight it and click the left-arrow button.
To change the order in which one or more action policies are executed, highlight the action policy and use the up-arrow or down-arrow to move the policy within the list.

Click the Save button to save the new automation policy.

Creating an Automation Policy to Run on a Schedule

After you create an automation schedule on the Automation Schedule Manager page (Registry > Run Book > Schedules), you can create an automation policy to run on a schedule.

To create an automation policy that runs based on an automation schedule:

Navigate to the Automation Policy Manager page (Registry > Run Book > Automation).
Click the Create button. The Automation Policy Editor page appears.
On the Automation Policy Editor page, supply a value in each of the following fields:

Policy Name. Name of the automation policy.
Policy Type. Select Scheduled.
Policy State. Specifies whether the automation policy can be executed (Enabled) or cannot be executed (Disabled).
Organization. Organization associated with the automation policy. The organization should be the same as the one associated with the automation schedule you want to use.
Align With. Specifies whether to align this automation policy with one or more devices, one or more device groups, or one or more organizations. Based on your setting, you must then specify the Devices, Device Groups, or Device in Organization in the field provided, as listed below.

Devices. The Available Devices field will appear below, allowing you to select devices to associate with the automation policy.
Device Groups. The Available Device Groups field will appear below, allowing you to select device groups to associate with the automation policy.
Policy Organization. The Available Devices in Organization field will appear below, allowing you to select one or more devices to associate with the automation policy. The list of devices comprises all devices in the organization specified in the Organization field.

Available Schedules. Displays a list of all automation schedules from the Automation Schedule Manager page that are not time-limited, that is, that do not have an set End Time. You can select one or more schedules in this field. To select an automation schedule, highlight it and click the right-arrow button.
Aligned Schedules. This pane displays a list of all automation schedules aligned with this automation policy. To de-select an automation schedule, highlight it and click the left-arrow button. To change the order in which one or more automation schedules are evaluated, highlight the action policy and use the up-arrow or down-arrow to move the policy within the list. If you selected multiple automation schedules in the automation policy, the automation schedules will be evaluated in the order specified in the Aligned Schedules field.

In the example below, we have created an automation policy to run daily CPU diagnostics on our "Windows Automation" device group using the Windows PowerShell: Daily Run CPU Diagnostics schedule we created. We selected Aligned Actions based on the tasks we want to happen during the automation run.

The automation schedule we created runs every day at 12:00 (America/NewYork timezone) with no end date. This automation schedule allows our automation policy to continue until we disable it.

Manually Executing a Scheduled Automation Policy

When you create a scheduled automation policy, SL1 will execute that automation policy according to the schedule, regardless of event status. However, you can also manually execute the scheduled automation policy at any time.

To manually execute a scheduled automation policy:

Navigate to the Automation Policy Manager page Registry > Run Book > Automation).
Locate the scheduled automation policy you want to manually execute and click its lightning bolt icon (). A confirmation message appears.
Click OK to continue. Depending on the policy, one of the following will happen:

If the scheduled automation policy is enabled and has at least one schedule aligned with it, the policy will execute immediately.
If the policy is disabled or does not have a schedule aligned with it, SL1 displays an error message and the policy will not execute.

"Clear" Policies

In an automation policy, the Policy Type field specifies whether the policy will be evaluated against active events or against cleared events.

If you create an automation policy with a Policy Type of Clear:

The automation policy will be evaluated only for cleared events.
The automation policy will contain only options for matching severity (Criteria Logic fields), matching ticket created or not created status (Criteria Logic fields), and matching text in an event message (Match Logic and Match Syntax fields).
The automation policies will run only once (when the event is cleared) for any given event.

Aligning an Automation Policy with the System Organization

In an automation policy, the Organization field specifies the organization to associate with the policy and tells the automation policy which devices to evaluate. If you select the System organization in the Organization field, the behavior of the Available Devices field is affected.

If you selected Devices in the Align With field, the Available Devices field is displayed in the Automation Policy Editor page.
In the Available Devices field, you can select one or more devices. The selected event(s) and event criteria must occur on at least one of the selected devices before the automation policy will be executed.

If you do not select any devices, the automation policy automatically evaluates all devices associated with the organization you selected in the Organization field.
If you do not select any devices and you selected System in the Organization field, the automation policy automatically evaluates all devices in SL1.

Ordering Actions in an Automation Policy

You can align multiple action policies with a single automation policy. In addition, you can specify the order in which the SL1 system executes those aligned action policies.

Action policies can use the variable %_EM7_RESULT_% to retrieve the results from the previously executed action policy. Therefore, it is important that you understand the dependencies between action policies before you specify the order in which aligned action policies are executed.

For details on the variable %_EM7_RESULT_%, see Using the Result of a Previous Action.

Automation Policies and Event Masks and Event Correlation

In SL1, events can be grouped together in a suppression group using event correlation or event masks. These grouped events can affect run book criteria.

If you selected the checkbox Trigger on Child Rollup, both the parent and all the child events in a suppression group can trigger the automation policy.

If you do not select the checkbox Trigger on Child Rollup, the default behavior is:

For event correlation, only the parent event can trigger the automation policy.
For event masks, only the event with the highest severity can trigger the automation policy. If multiple events have the highest severity, only the event with the highest severity and the earliest timestamp can trigger the automation policy.

Events Not Displayed on the Events Page that Might Affect Automation Policies

There are four types of events that might not be displayed on the Events page. Two of them have an effect on Automation Policies:

Topology Events. In SL1, event correlation or topology suppression means the ability to build parent-child relationships between events. When events are correlated, only the parent event is displayed on the Events page. The child events are rolled up and nested under the parent event and are displayed only if you click on the magnifying-glass icon (). For the parent event, the count column will be incremented to indicate the number of correlated child events.
Event Masks. In the Device Properties page for each device, you can define an Event Mask. When a device uses the Event Mask setting, events that occur on a single device within a specified span of time are grouped together. On the Events page, masked events are nested under the event with the highest severity. The magnifying-glass icon () appears to the left of the event. When you click on the magnifying-glass icon, the nested events are displayed.

The first time an event triggers an automation policy, SL1 will check to see if that event is the parent event of a suppression group due to topology events or an event mask. If the event is part of a suppression group, SL1 will trigger the automation policy only if the event is the parent event in the suppression group. Only that single event will trigger the automation policy; other events in the suppression group will not trigger the automation policy. For all future instances, only that event with the highest severity will trigger the automation policy.

Example

Suppose you have a high-security project that requires hardware to be extremely responsive.
Suppose this project uses Cisco network hardware.
Suppose you want to notify key personnel immediately if the Cisco network hardware is too slow.
You could define an automation policy that specifies the Cisco hardware to monitor and the event that is triggered when speeds are too slow.

The event is called "Critical: Cisco: Configuration Interface Speed to Slow".

You could align the automation policy with an action policy that sends an email to key personnel. The action policy could send these emails to the handheld devices for these key personnel.
The action policy is called "Email_sysadmins".

Our example automation policy might look like this:

We specified that the automation policy:

Should act upon active events.
Is enabled.
Is associated with the organization "System".
Will be triggered by the specified event when the event has a severity greater than "Healthy".
Will be triggered as soon as the specified event occurs.
The policy will continue to trigger the action every 1 minute until the event is cleared.
Will be triggered when the selected event occurs on at least one of the selected Cisco devices.
Will be triggered when the event "Critical: Cisco: Configuration Interface Speed to Slow" occurs on the selected Cisco devices.
Will be triggered at all times.

We specified that when all the criteria in the automation policy are met, the action policy "Send Email" will be executed.

Editing an Automation Policy

You can edit any parameters of an existing automation policy. To do so:

Navigate to the Automation Policy Manager page (Registry > Run Book > Automation). In the Automation Policy Manager page, find the automation policy you want to edit. Click its wrench icon ().
The Automation Policy Editor modal page appears, populated with values from the selected automation policy.

You can edit the values in one or more fields. For a description of each field, see the previous section on creating an automation policy.
Click the Save button to save your changes to the automation policy.

Bulk Actions for Automation Policies

From the Automation Policy Manager page (Registry > Run Book > Automation), you can enable, disable, or delete one or more policies as a bulk action.

Navigate to the Automation Policy Manager page (Registry > Run Book > Automation).
In the Automation Policy Manager page, select the checkbox () next to any policy you want to enable, disable, or delete. You can select more than one policy.
Go to the Select Action field in the lower right corner of the page. Select the action you want to take: Delete Policies, ENABLE these Automation Policies, or DISABLE these Automation Policies.
Click the Go button.

Updating Run Book Engine Settings

The process that executes Run Book tasks is automated, and the default Run Book Automation executor settings are appropriate for most SL1 systems. However, users can change their Run Book Automation settings to support extremely large SL1 systems. More specifically, users can adjust the settings for the executor count respective to their primary task's queue preference.

Users can configure the automation policies to be of a specific type of queue. The policy settings that a user chooses determines which task queue the automation engine will group to.

An RBA Executor is an individual process that executes automation tasks. If your Run Book Automations are not running as expected, you might need to increase the number of RBA Executors.

On the Run Book Engine Settings page, you can edit the following settings related to RBA Executors:

Default Executors. The number of RBA Executors that prioritize default configured Run Book Automations. The default is 1.
High Priority Executors. The number of RBA Executors that prioritize high priority configured Run Book Automations. the defalut is 2.
Scheduled Executors. The number of RBA Executors that prioritize scheduled Run Book Automations. The default is 1.
User-Initiated Executors. The number of RBA Executors that prioritize user-initiated Run Book Automations. The default is 1.

To adjust the number of executors on this page:

Slide the dial next to the desired task queue to the appropriate number. Or enter the number in the text box located to the right of sliding dial.
Slide the dial next to the desired task queue to the appropriate number. Or enter the number in the text box located to the right of sliding dial.
Click Save Settings after you make any edits to this page.

NOTE: All of the queues are shared by the automation engine. Meaning, that each executor does not have different queues containing different data. Also, depending on the settings' configuration, the executors will consume the queues according to the selected automation group. If there is no task present in the primary queue, the automation will move to the next queue.

To assure timely job execution for respective queue tasks loads, the executor count for those queue should be sized appropriately. For example, if a considerable number of your Automation policy executions are configured to utilize the High Priority Queue, a single executor may not be sufficient to handle the queue on its own and rely on other queue workers to assist (if they’re available). By setting executor counts respective to expected queue tasks loads expected an SL1 administrator can ensure executors prioritize accordingly.

For any major setting adjustments, please contact ScienceLogic Customer Support.