We have configured TrueSight integration with Entuity to forward Entuity incident to TrueSight server cell however Entuity events are not visible in TrueSight console.
We have checked the Entuity logs (BemEventEngineSent) and confirmed that incident are successfully sent to TrueSight but not able to see the same in TrueSight.
It was identified that Entuity integration related classes and MRL rules were not enabled in TrueSight cell KB as a result all Entuity incidents i.e. EYE_EVENT class events were converted into MC_CELL_UNDEFINED_CLASS class events as Cell does not have definition of the EYE_EVENT class.
EVNT*41 0 1802 MC_CELL_UNDEFINED_CLASS;
mc_tool='Eye of the Storm';
mc_long_msg='Network Outage on EDX-XXX-XX-EWR.xxx.gov.xx - Node Unreachable: EDX-XXX-XX-EWR.xxx.gov.xx';
msg='Network Outage on EDX-XXX-XX-EWR.xxx.gov.xx';
mc_operations=[0x5b751304,'refine_multiple_server_events.mrl:refine initialize_core_event','','Initialized CORE_EVENT slots specific to CI association',''];
Follow below steps to enable Entuity integration related classes and rules in TrueSight cell which is receiving Entuity events.
1) Make sure eye_event.baroc file is present in $MCELL_HOME\etc\pncell_XXXXX\kb\classes directory and add following entry in .load file located under same directory.
2) Likewise, make sure eye_integration.mrl file is present in $MCELL_HOME\etc\pncell_XXXXX\kb\rules directory and add following entry in .load file located under same directory.
3) Compile the cell KB with below command followed by restart of the cell.
> mccomp -n <cell_name>
After this, Entuity events should start appearing in TrueSight console.
Note: Entuity integration related rules and classes are not enabled by default and it should be enabled when Entuity integration is enabled.