Event rule examples

The following are examples of event rule definitions that apply to the scenarios described in Simple event rule scenarios.

Event rule definition for scenario #1

When any of the job123 jobs terminates in error and yields the following error message:

AWSBHT001E The job "MYWORKSTATION#JOBS.JOB1234" in file "ls" has failed with 
the error: AWSBDW009E The following operating system error occurred retrieving 
the password structure for either the logon user...

send an email to operator john.smith@mycorp.com. The subject of the email includes the names of the job instance and of the associated workstation.

The event rule is valid from December 1st to December 31st in the 12:00-16:00 EST time window.

<?xml version="1.0"?>
   <eventRuleSet xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xmlns="http://www.ibm.com/xmlns/prod/tws/1.0/event-management/rules"
      xsi:schemaLocation="http://www.ibm.com/xmlns/prod/tws/1.0/
                          event-management/rules/EventRules.xsd">
                          <eventRule name="scenario1_rule" ruleType="filter" isDraft="no">
                          <description>This is the definition for scenario1</description>
                          <timeZone>America/Indianapolis</timeZone>
   <validity from="2015-12-01" to="2015-12-31" />
   <activeTime start="12:00:00" end="16:00:00" />
   <eventCondition name="event1" 
                      eventProvider="TWSObjectsMonitor" 
                      eventType="JobStatusChanged">
                      <filteringPredicate>
                      <attributeFilter name="JobStreamWorkstation" operator="eq">
                      <value>*</value>
                      </attributeFilter>
                      <attributeFilter name="JobStreamName" operator="eq">
                      <value>*</value>
                      </attributeFilter>
                      <attributeFilter name="JobName" operator="eq">
                      <value>job123*</value>
                      </attributeFilter>
                      <attributeFilter name="Status" operator="eq">
                      <value>Error</value>
                      </attributeFilter>
                      <attributeFilter name="ErrorMessage" operator="eq">
                      <value>*AWSBDW009E*</value>
                      </attributeFilter>
                      </filteringPredicate>
                      </eventCondition>
                      <action actionProvider="MailSender" 
              actionType="SendMail" 
              responseType="onDetection">
              <description>Send email to John Smith including names of job 
              and associated workstation</description>
   <parameter name="To">
   <value>john.smith@mycorp.com</value>
   </parameter>
   <parameter name="Subject">
   <value>Job %{event1.JobName} on agent %{event1.Workstation} 
   ended in error</value>
   </parameter>
   </action>
   </eventRule>
   </eventRuleSet>

Important: The error message that explains why a job terminates in error can be found in the TWSMERGE log file. In this scenario, the TWSMERGE log file contains the following statement:

BATCHMAN:+ 
BATCHMAN:+ AWSBHT001E The job "MYWORKSTATION#JOBS.JOB1234" in file "ls"
has failed with the error: AWSBDW009E The following operating system 
error occurred retrieving the password structure for either the logon 
user, or the user who owns a file or external dependency
BATCHMAN:+

where the error message is everything that follows the string:

has failed with the error:

Event rule definition for scenario #2

If workstation CPU1 becomes unlinked and does not link back within 1 hour, send a notification email to chuck.derry@mycorp.com.

<?xml version="1.0"?>
      <eventRuleSet xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	      xmlns="http://www.ibm.com/xmlns/prod/tws/1.0/event-management/rules"
	      xsi:schemaLocation="http://www.ibm.com/xmlns/prod/tws/1.0/
              event-management/rules http://www.ibm.com/xmlns/prod/tws/1.0/
              event-management/rules/EventRules.xsd">
              <eventRule name="SCENARIO2_RULE" ruleType="sequence" isDraft="no">
              <description>This is the definition for scenario2</description>
              <timeZone>America/Anchorage</timeZone>
              <timeInterval amount="10" unit="minutes"/>
              <eventCondition name="WSevent" 
                             eventProvider="TWSObjectsMonitor" 
                             eventType="ChildWorkstationLinkChanged">
                             <scope>
			    * TO CPU1
			    </scope>
			    <filteringPredicate>
			    <attributeFilter name="Workstation" operator="eq">
			    <value>CPU1</value>
			    </attributeFilter>
			    <attributeFilter name="LinkStatus" operator="eq">
			    <value>Unlinked</value>
			    </attributeFilter>
			    </filteringPredicate>
			    </eventCondition>
			    <eventCondition name="childWksLnkChgEvt1" 
                             eventProvider="TWSObjectsMonitor" 
                             eventType="ChildWorkstationLinkChanged">
                             <scope>
				* TO CPU1
				</scope>
				<filteringPredicate>
				<attributeFilter name="Workstation" operator="eq">
				<value>CPU1</value>
				</attributeFilter>
				<attributeFilter name="LinkStatus" operator="eq">
				<value>Linked</value>
				</attributeFilter>
				</filteringPredicate>
				</eventCondition>
				<action actionProvider="MailSender" actionType="SendMail" 
              responseType="onTimeOut">
              <scope>
			   CHUCK.DERRY@MYCORP.COM : AGENT CPU1 HAS BEEN UNLINKED FOR AT LEAST 10 MINUTES
			   </scope>
			   <parameter name="Subject">
			   <value>Agent CPU1 has been unlinked for at least 10 minutes</value>
      </parameter>
      <parameter name="To">
      <value>chuck.derry@mycorp.com</value>
      </parameter>
      <parameter name="Body">
      <value>The cause seems to be: %{WSevent.UnlinkReason}</value>
      </parameter>
      </action>
      </eventRule>
      </eventRuleSet>

Event rule definition for scenario #3

When file daytransac is created in the SFoperation directory in workstation system1, and modifications to the file have terminated, submit the calmonthlyrev job stream.

The event rule is valid year-round in the 18:00-22:00 EST time window.

<?xml version="1.0"?>
      <eventRuleSet xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xmlns="http://www.ibm.com/xmlns/prod/tws/1.0/event-management/rules"
      xsi:schemaLocation="http://www.ibm.com/xmlns/prod/tws/1.0/
                          event-management/rules/EventRules.xsd">
                          <eventRule name="scenario3_rule" 
              ruleType="filter" 
              isDraft="no">
              <description>This is the definition for scenario3</description>
              <timeZone>America/Louisville</timeZone>
      <validity from="2015-01-01" to="2015-12-31" />
      <activeTime start="18:00:00" end="22:00:00" />
      <eventCondition eventProvider="FileMonitor" 
                      eventType="ModificationCompleted">
                      <filteringPredicate>
                      <attributeFilter name="FileName" operator="eq">
                      <value>daytransac</value>
                      </attributeFilter>
                      <attributeFilter name="Workstation" operator="eq">
                      <value>EVIAN1</value>
                      </attributeFilter>
                      </filteringPredicate>
                      </eventCondition>
                      <action actionProvider="TWSAction" 
              actionType="sbs" 
              responseType="onDetection">
              <description>Submit the calmonthlyrev job stream.</description>
              <parameter name="JobStreamName">
              <value>calmonthlyrev</value>
      </parameter>
      <parameter name="JobStreamWorkstationName">
      <value>act5cpu</value>
      </parameter>
      </action>
      </eventRule>
      </eventRuleSet>

Event rule definition for scenario #4

When the job-x=exec event and the job-x=succ/abend event are received in 500 seconds, the scheduler should reply Yes to prompt-1 and start the jobstream-z job stream, otherwise it should send an email to twsoper@mycompany.com alerting that the job is late.

<?xml version="1.0"?>
      <eventRuleSet xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xmlns="http://www.ibm.com/xmlns/prod/tws/1.0/event-management/rules"
      xsi:schemaLocation="http://www.ibm.com/xmlns/prod/tws/1.0/
                          event-management/rules/EventRules.xsd">
                          <eventRule name="scenario4_rule" 
              ruleType="sequence" 
              isDraft="yes">
              <description>This is the definition for scenario4</description>
              <timeZone>America/Buenos_Aires</timeZone>
      <timeInterval amount="500" unit="seconds" />
      <eventCondition eventProvider="TWSObjectsMonitor" 
                      eventType="JobStatusChanged">
                      <filteringPredicate>
                      <attributeFilter name="JobName" operator="eq">
                      <value>job-x</value>
      </attributeFilter>
      <attributeFilter name="InternalStatus" operator="eq">
      <value>EXEC</value>
      </attributeFilter>
      </filteringPredicate>
      </eventCondition>
      <eventCondition eventProvider="TWSObjectsMonitor" 
                      eventType="JobStatusChanged">
                      <filteringPredicate>
                      <attributeFilter name="JobName" operator="eq">
                      <value>job-x</value>
                      </attributeFilter>
                      <attributeFilter name="InternalStatus" operator="eq">
                      <value>ABEND</value>
                      <value>SUCC</value>
                      </attributeFilter>
                      </filteringPredicate>
                      </eventCondition>
                      <action actionProvider="MailSender" 
              actionType="SendMail" 
              responseType="onTimeOut">
              <description>Send email to operator saying that job-x 
              is late</description>
              <parameter name="To">
              <value>twsoper@mycorp.com</value>
      </parameter>
      <parameter name="Subject">
      <value>Job-x is late by at least 5 minutes</value>
      </parameter>
      </action>
      <action actionProvider="TWSAction" 
              actionType="Reply" 
              responseType="onDetection">
              <description>Reply Yes to prompt-1</description>
              <parameter name="PromptName">
         <value>prompt-1</value>
         </parameter>
         <parameter name="PromptAnswer">
         <value>Yes</value>
         </parameter>
         </action>
         <action actionProvider="TWSAction" 
              actionType="sbs" 
              responseType="onDetection">
              <description>Submit jobstream-z</description>
              <parameter name="JobStreamName">
              <value>jobstream-z</value>
              </parameter>
              <parameter name="JobStreamWorkstationName">
              <value>act23cpu</value>
              </parameter>
              </action>
              </eventRule>
              </eventRuleSet>

Event rule definition for scenario #5

Monitor the status of HCL Workload Automation processes listed in ProcessName and run the RUNCMDFM.BAT batch script located in E:\production\eventRules.

The TWSPATH keyword indicates the fully qualified path where the monitored HCL Workload Automation instance is installed, including the /TWS suffix.

On Windows operating systems, the event rule is triggered every time the agent is stopped using the ShutDownLwa command and every time the agent is stopped manually. On UNIX operating systems, the event rule is triggered when you stop the process manually, while it is not triggered by the ShutDownLwa command.

If you specify ProcessName=agent, the agent component is monitored, while the TWS JobManager process is not monitored.

<?xml version="1.0"?>
      <eventRuleSet xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xmlns="http://www.ibm.com/xmlns/prod/tws/1.0/event-management/rules"
      xsi:schemaLocation="http://www.ibm.com/xmlns/prod/tws/1.0/
                          event-management/rules/EventRules.xsd">
                          <eventRule name="scenario5rule" ruleType="filter" isDraft="no">
                          <eventCondition name="twsProcMonEvt1" 
        eventProvider="TWSApplicationMonitor"
        eventType="TWSProcessMonitor">
        <scope>
                AGENT, NETMAN DOWN ON WIN86MAS
                </scope>
                <filteringPredicate>
                <attributeFilter name="ProcessName" operator="eq">
                <value>agent</value>
                <value>appservman</value>
                <value>batchman</value>
                <value>jobman</value>
                <value>mailman</value>
                <value>monman</value>
                <value>netman</value>
                </attributeFilter>
                <attributeFilter name="TWSPath" operator="eq">
                <value>E:\Program Files\HCL\TWA\TWS</value>
      </attributeFilter>
      <attributeFilter name="Workstation" operator="eq">
      <value>win86mas</value>
      </attributeFilter>
      <attributeFilter name="SampleInterval" operator="eq">
      <value>5</value>
      </attributeFilter>

</filteringPredicate>
</eventCondition>
<action actionProvider="GenericActionPlugin" actionType="RunCommand" 
			 responseType="onDetection">
			 <scope>
                RUNCMDFM.BAT
                </scope>
                <parameter name="Command">
                <value>runCmdFM.bat</value>
      </parameter>
      <parameter name="WorkingDir">
      <value>E:\production\eventRules</value>
      </parameter>
      </action>
      </eventRule>
      </eventRuleSet>

Event rule definition for scenario #7

Monitor the Symphony file status in the IT041866-9088 workstation and logs the occurrence of a corrupt Symphony record in the internal auditing log database.

In each workstation, the Batchman process monitors the Symphony file. When it detects a corrupt record, it send the corruption event to the Monman process message queue and then to Event Processor in the Master workstation.

The event rule is triggered every time the Batchman process finds a corrupt dependency record in the workstation specified in the event rule definition.

If you set the workstation value to IT041866-9088, the Symphony file on this workstation is monitored, and the event rule is triggered when the Batchman process on this workstation detects a corrupt record in the Symphony file.

The occurrence of the corrupt record is written to the Messagge logger audit file.

?xml version="1.0"?>
   <eventRuleSet xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="http://www.ibm.com/xmlns/prod/tws/1.0/event-management/rules"
xsi:schemaLocation="http://www.ibm.com/xmlns/prod/tws/1.0/event-management/rules 
http://www.ibm.com/xmlns/prod/tws/1.0/event-management/rules/EventRules.xsd"> 
<eventRule name="TEST1" ruleType="filter" isDraft="no">
<eventCondition name="productAlertEvt1" eventProvider="TWSObjectsMonitor" 
eventType="ProductAlert">
<scope>
IT041866-9088
</scope>
   <filteringPredicate>
   <attributeFilter name="Workstation" operator="eq">
   <value>IT041866-9088</value>
   </attributeFilter>

</filteringPredicate>
</eventCondition>
<action actionProvider="MessageLogger" actionType="MSGLOG" 
responseType="onDetection">
<scope>
OBJECT=%{PRODUCTALERTEVT1.WORKSTATION} MESSAGE=%{PRODUCTALERTEVT1.WORKSTATION} 
corruption
</scope>
<parameter name="ObjectKey">
<value>%{productAlertEvt1.Workstation}</value>
   </parameter>
   <parameter name="Message">
   <value>%{productAlertEvt1.Workstation} corruption</value>
   </parameter>
   <parameter name="Severity">
   <value>Info</value>
   </parameter>
   </action>
   </eventRule>
   </eventRuleSet>