Enterprise Manager (EM) 12c allows you to create an incident rule to send a notification and/or create an incident after an event has been open for a specified period. Such an incident rule will help prevent premature alerts on issues that may correct themselves within a certain amount of time.

For example, there are some agents in an unstable network area, and often there are communication failures between the agents and the OMS lasting three, four minutes at a time. In this scenario, you may only want to receive alerts after an agent in that area has been in the Agent Unreachable status for at least five minutes.

This article provides a step-by-step guide for creating an incident rule set to cater for the above scenario, that is, to create an incident and send a notification after the Agent Unreachable event has remained open for a five-minute duration.

Steps to create the incident rule

1.     Log on to the console and navigate to Setup -> Incidents -> Incident Rules.

The Incident Rules - All Enterprise Rules page displays.

2.     Click Create Rule Set …

The Create Rule Set page displays.

3.     Enter a name for the rule set (e.g. Rule set for agents in flaky network areas), optionally enter a description, and leave everything else at default values, and click + Add.

The Search and Select: Targets page pops up.

---

Note:  While you can create a rule set for individual targets, it is a best practice to use a group for this purpose.

---

4.     Select an appropriate group, e.g. the AgentsInFlakyNework group. The Select button becomes enabled, click the button.

The Create Rule Set page displays.

5.     Leave everything at default values, and click the Rules tab.

The Create Rule Set page displays.

6.     Click Create…

The Select Type of Rule to Create page pops up.

7.     Leave the Incoming events and updates to events option selected, and click Continue.

The Create New Rule : Select Events page displays.

8.     Select Target Availability from the Type drop-down list.

The page shows more options for Target Availability.

9.     Select the Specific events of type Target Availability option, and click + Add.

The Select Target Availability events page pops up.

10.   Select Agent from the Target Type dropdown list.

The page expands.

11.   Click the Agent unreachable checkbox, and click OK.

---

Note: If you want to also receive a notification when the event is cleared, click the Agent unreachable end checkbox as well before clicking OK.

---

The Create New Rule : Select Events page displays.

12.   Click Next.

The Create New Rule : Add Actions page displays.

13.   Click + Add.

The Add Actions page displays.

14.   Do the following:

a.     Select the Only execute the actions if specified conditions match option (You don’t want the action to trigger always).

The following options appear in the Conditions for Actions section.

b.     Select the Event has been open for specified duration option.

The Conditions for actions section expands.

c.     Change the values of Event has been open for to 5 Minutes as shown below.

d.     In the Create Incident or Update Incident section, click the Create Incident checkbox as following:

e.     In the Notifications section, enter an appropriate EM user or email address in the E-mail To field.

f.     Click Continue (in the top right hand corner).

The Create New Rule : Add Actions page displays.

15.   Click Next.

The Create New Rule : Specify name and Description page displays.

16.   Enter a rule name, and click Next.

The Create New Rule : Review page appears.

17.   Click Continue, and proceed to save the rule set.

The incident rule set creation completes.

After one of the agents in the group specified in the rule set is stopped for over 5 minutes, EM will send a mail notification and create an incident as shown in the following screenshot.

In conclusion, you have seen the steps to create an example incident rule set that only creates an incident and triggers a notification after an event has been open for a specified period. Such an incident rule can help prevent unnecessary incidents and alert notifications leaving EM administrators time to more important tasks.

- Loc Nhan