How do I enrich events from ncp_poller?
Hi,
I'm currently enriching events with Location data but this only applies to traps (according to http://www-01.ibm.com/support/knowledgecenter/SSSHRK_4.1.0/itnm/ip/wip/event/task/nmip_evnt_enrichingeventwithmainnodedevicelocation.html). In addition I have poller configured to ping my devices (chassis ping). Those devices are also SNMP-enabled and discovered with sysLocation. I'd like to enrich Ping fail events in Omnibus coming from ncp_poller with sysLocation field value. How do I do this?
That document looks pretty good. Here is the 4.1.1 link for what you pasted.
So I went ahead and tested this out, and I followed the document exactly as described above.
And it didn't work. I actually had a parse error in the stitcher when I pasted lines 1-10 as described in the doc.
Record mainNode = GwMainNodeLookupUsing( "LocalNodeAlias" );
if ( mainNode NULL )
{
text sysLocation = @mainNode.snmpSystem.SYSLOCATION;
if ( sysLocation <> eval(text, '&Location') )
{
@enrichedFields.Location = sysLocation }
}
But I think there should be a semi-colon after the equate in the 'if' statement. So now I have this
Record mainNode = GwMainNodeLookupUsing( "LocalNodeAlias" );
if ( mainNode NULL )
{
text sysLocation = @mainNode.snmpSystem.SYSLOCATION;
if ( sysLocation <> eval(text, '&Location') )
{
@enrichedFields.Location = sysLocation;
}
}
And it works. I used a Chassis ping and I have valid data in SysLocation in both chassis and mainNodeDetails. This data was placed in 'Location' in alerts.status for each failing chassis ping. And I kept Location as the field in the EventGatewaySchema in the ncp2nco section.
Also note my formatting might be a bit off, but I slid the curly brace where the semi colon was missing to the next line just to make this more readable.
Works perfect! Indeed there is a mistake in documentation.
I have confirmed with development that there is a typo or error in the doc, and have informed the documentation group.