Configuring yarpd
RiverMuse Core 4.1.7
|
Yet Another Rule Processing Daemon (yarpd) is a standalone daemon program for performing the correlation between incoming alerts. yarpds behavior is defined by real-time conditions and timed conditions. yarpd places conditions on the alerts table. Conditions watch for certain alerts to occur or alter. When a rule parameter in the conditions table evaluates to TRUE an action indicated by the up_action parameter will execute; otherwise no action is run, unless the condition is of type 'edge' then the down_action parameter will execute.
You can configure both conditions and actions; however, RiverMuse currently provides no GUI, so all configuration must be done by using the MySQL command line utility.
Prerequisites
- RiverMuse recommends before you begin configuring conditions and actions, you review the yarpd overview documentation.
- If you are not familiar with MySQL, RiverMuse suggests you review the MySQL 5.0 Reference Manual statement syntax.
- RiverMuse recommends familiarizing yourself with the rivermuse database tables that relate to yarpd.
Learning by worked example
The following examples provide you with a guide on how to create conditions and actions using MySQL command line statements that set the parameters in the conditions and actions table.
|
|
Worked example for LinkUp type alerts
The following condition/action pair looks for LinkUp type alerts and updates the corresponding LinkDown type alert as explained below:
Creating the real-time condition
The condition is defined here as real-time; the following SQL command inserts the condition into the rivermuse database:
Creating the action
The action is defined here as an alert update type; as above, the SQL command below inserts the action into the rivermuse database:
- Note the filter field uses $ syntax to match the correct LinkDown type alert for the LinkUp alert that triggered the condition.
- Sets severity to $Clear in the alerts table.
- Sets state to $Resolved in the alerts table.
Worked example for PingRestore type alerts
The following condition/action pair looks for PingRestore type alerts.
Creating the real-time condition
The following SQL command inserts the condition into the rivermuse database:
Creating the action
The action is defined here as a close action PingClear; as above, the SQL command below inserts the action into the rivermuse database:
- The close is done by specifying the discriminator.
Worked example for alerts of type SpaceWarn
The following condition/action pair, looks for alerts of type SpaceWarn, '$type="SpaceWarn"', and runs an event create action, to create an 'Assign' event, which will cause the system to assign the alert to user $phil.
Creating the real-time condition
Creating the action
- Running an event create action, this is signified by the constant '2' in the ActionType column.
- Creates an assign event, which assigns the alerts matched by the condition to user Phil, $phil.
- Note the discriminator is used in the action, '$agent$entity#SpaceWarn', which evaluates to match the discriminator of the triggering alert. This ensures that the 'Assign' event acts on the triggering alert.
Worked example for alert update action
The following timed condition is calling an alert update action, which changes the alert description, to indicate that the alert is older than an hour.
Creating the timed condition
- The condition is run every 30 seconds.
- Calls TimerUp action for all alerts of type LinkDown ($type="LinkDown"), and counts greater than 1,($count>1), with last occurred field being time longer than an hour, ($last_occurred < ("$NOW-$HOUR")).
Creating the action
