A PATROL Agent disconnect event will be generated with OK severity. After 5 minutes, if the event is still open it will be changed to CRITICAL severity. How can the change to CRITICAL severity be stopped? |
There are two rules in pw\server\etc\<cell>\kb\rules\ppm_sm_ev.mrl that change the severity to CRITICAL after 5 minutes: new set_timer_pa_disc_to_crit : PPM_SM_EV($EV) where [ $EV.status != CLOSED AND $EV.mc_origin_class equals PROACTIVENET_SLFMON_COMPONENT AND $EV.severity equals OK AND $EV.mc_object has_prefix 'PA:' AND $EV.msg has_suffix localize(kb,[patrol_agent_disconnect]) ] triggers { set_timer($EV, 300, PATROL_SM_TO_CRITICAL); } END timer inc_pa_disc_to_crit : PPM_SM_EV($EV) where [ $EV.status != CLOSED AND $EV.mc_origin_class equals PROACTIVENET_SLFMON_COMPONENT AND $EV.severity equals OK AND $EV.mc_object has_prefix 'PA:' AND $EV.msg has_suffix localize(kb,[patrol_agent_disconnect]) ] timer_info: == PATROL_SM_TO_CRITICAL { $EV.severity = CRITICAL; $EV.mc_priority = PRIORITY_1; } END Comment the two rules, save the file, recompile the cell KB with 'mccomp -n <cell>' and restart the cell. |