In ENA, you can create a custom event that is raised in response to a user defined polling event.
- In the following example, we have created a user defined attribute to monitor the number of currently-established TCP connections to a device. In this example, the attribute name is ud_tcpCurrEstab:
- When the value of this attribute exceeds a threshold, a critical severity event (User Defined Attribute Value Critical) will be generated:
- We want to convert this event into a custom event called 'TCP Currently Established Count High'. To do so, we will define the custom event and add a generic rule to the EMS configuration:
- This rule has two conditions:
- the first checks that this is the User Defined Attribute Value Critical event.
- the second checks the attribute name in the sourceExternalId attribute.
- In this example, note that the new event is given a severity of Minor(1), and the action to change the event type has the option selected to update the event severity as well as the event name.
- When the number of TCP connections exceeds the threshold, the custom event is raised instead of the original User Defined Attribute Value Critical event, and the severity is Minor(1) rather than the original Critical(5):
- When the threshold is no longer exceeded, a User Defined Attribute Value Abnormality Cleared event will be raised. A similar rule can be created to create a specific clearing event based on the attribute name being passed in the sourceExternalId event attribute as described above.