We have a custom MRL which throws below rule while processing event. Error 1001 occurred during processing of event <event_handle>: Evaluation of function tf_next_start(Production) failed $START = tf_next_start($EV.itsm_environment); What is expected from the MRL rule is to find an appropriate timeframe as per environment name in "itsm_environment" slot of event and if this timeframe is currently not active then, rule should set a timer on the event so that it does not appear on console i.e. ($EV.n_cc_visible = NO) until timeframe window is started. new cc_visible_event_no: N_EVENT ($EV) where [ $EV.severity == CRITICAL ] triggers { $START=tf_next_start($EV.itsm_environment); set_timer_at($EV,$START,$EV.itsm_environment); ntadd($EV,concat(["Event with environment ", $EV.itsm_environment, " will be hidden in CC until ",time_stamp_to_str($START,'%d-%m-%Y %H:%M:%S')])); $EV.n_cc_visible = NO; } END |
The problem was due to incorrect input in tf_next_start() primitive, it expects timeframe data object as an input but reference to a slot of event object was privided instead. tf_next_start() primitive obtains the start time of the next active interval of a time frame and the syntax for tf_next_start/2 is as follows: tf_next_start($TIMEFRAME,$START) $START=tf_next_start($TIMEFRAME) Refer : https://docs.bmc.com/docs/pages/viewpage.action?pageId=722074026 Corrected MRL's as below and it works as expected. new cc_visible_event_no: EVENT ($EV) where [$EV.severity == CRITICAL AND (NOT tf_active($TIME))] using { TIME_FRAME ($TIME) where [$TIME.name == $EV.itsm_environment] } triggers { $START=tf_next_start($TIME); set_timer_at($EV,$START,cc_event_visiblity_timeout); ntadd($EV,concat(["Event with environment ", $EV.itsm_environment, " will be hidden in CC until ",time_stamp_to_str($START,'%d-%m-%Y %H:%M:%S')])); $EV.n_cc_visible = NO; } END Above rule will find timeframe object with name same as itsm_environment slot of incoming event. If timeframe is present it will obtain the start time of the next active interval of a time frame and set the timer on event. But if there is no timeframe present with given name then this rule won't execute "triggers" block and no timer will be set. # Below timer rule will change the cc_visible slot to YES once timer set on event is expired. timer cc_event_visiblity_timeout_operation: EVENT ($EV) where [ $EV.status != CLOSED] timer_info: equals cc_event_visiblity_timeout { $EV.cc_visible = YES; ntadd($EV,concat(["Event with environment ", $EV.itsm_environment, " is now visible "])); } END |