Event rule examples
The following are examples of event rule definitions that apply to the scenarios described in Simple event rule scenarios.
Event rule definition for scenario #1
job123
jobs terminates in error and yields
the following error message: AWSBHT001E The job "MYWORKSTATION#JOBS.JOB1234" in file "ls" has failed with
the error: AWSBDW009E The following operating system error occurred retrieving
the password structure for either the logon user...
send
an email to operator john.smith@mycorp.com
. The subject
of the email includes the names of the job instance and of the associated
workstation. The event rule is valid from December 1st to December 31st in the 12:00-16:00 EST time window.
<?xml version="1.0"?>
<eventRuleSet xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="http://www.ibm.com/xmlns/prod/tws/1.0/event-management/rules"
xsi:schemaLocation="http://www.ibm.com/xmlns/prod/tws/1.0/
event-management/rules/EventRules.xsd">
<eventRule name="scenario1_rule" ruleType="filter" isDraft="no">
<description>This is the definition for scenario1</description>
<timeZone>America/Indianapolis</timeZone>
<validity from="2015-12-01" to="2015-12-31" />
<activeTime start="12:00:00" end="16:00:00" />
<eventCondition name="event1"
eventProvider="TWSObjectsMonitor"
eventType="JobStatusChanged">
<filteringPredicate>
<attributeFilter name="JobStreamWorkstation" operator="eq">
<value>*</value>
</attributeFilter>
<attributeFilter name="JobStreamName" operator="eq">
<value>*</value>
</attributeFilter>
<attributeFilter name="JobName" operator="eq">
<value>job123*</value>
</attributeFilter>
<attributeFilter name="Status" operator="eq">
<value>Error</value>
</attributeFilter>
<attributeFilter name="ErrorMessage" operator="eq">
<value>*AWSBDW009E*</value>
</attributeFilter>
</filteringPredicate>
</eventCondition>
<action actionProvider="MailSender"
actionType="SendMail"
responseType="onDetection">
<description>Send email to John Smith including names of job
and associated workstation</description>
<parameter name="To">
<value>john.smith@mycorp.com</value>
</parameter>
<parameter name="Subject">
<value>Job %{event1.JobName} on agent %{event1.Workstation}
ended in error</value>
</parameter>
</action>
</eventRule>
</eventRuleSet>
BATCHMAN:+
BATCHMAN:+ AWSBHT001E The job "MYWORKSTATION#JOBS.JOB1234" in file "ls"
has failed with the error: AWSBDW009E The following operating system
error occurred retrieving the password structure for either the logon
user, or the user who owns a file or external dependency
BATCHMAN:+
where the error message is everything that follows
the string: has failed with the error:
Event rule definition for scenario #2
CPU1
becomes unlinked and does not link back within 1
hour, send a notification email to
chuck.derry@mycorp.com
.<?xml version="1.0"?>
<eventRuleSet xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="http://www.ibm.com/xmlns/prod/tws/1.0/event-management/rules"
xsi:schemaLocation="http://www.ibm.com/xmlns/prod/tws/1.0/
event-management/rules http://www.ibm.com/xmlns/prod/tws/1.0/
event-management/rules/EventRules.xsd">
<eventRule name="SCENARIO2_RULE" ruleType="sequence" isDraft="no">
<description>This is the definition for scenario2</description>
<timeZone>America/Anchorage</timeZone>
<timeInterval amount="10" unit="minutes"/>
<eventCondition name="WSevent"
eventProvider="TWSObjectsMonitor"
eventType="ChildWorkstationLinkChanged">
<scope>
* TO CPU1
</scope>
<filteringPredicate>
<attributeFilter name="Workstation" operator="eq">
<value>CPU1</value>
</attributeFilter>
<attributeFilter name="LinkStatus" operator="eq">
<value>Unlinked</value>
</attributeFilter>
</filteringPredicate>
</eventCondition>
<eventCondition name="childWksLnkChgEvt1"
eventProvider="TWSObjectsMonitor"
eventType="ChildWorkstationLinkChanged">
<scope>
* TO CPU1
</scope>
<filteringPredicate>
<attributeFilter name="Workstation" operator="eq">
<value>CPU1</value>
</attributeFilter>
<attributeFilter name="LinkStatus" operator="eq">
<value>Linked</value>
</attributeFilter>
</filteringPredicate>
</eventCondition>
<action actionProvider="MailSender" actionType="SendMail"
responseType="onTimeOut">
<scope>
CHUCK.DERRY@MYCORP.COM : AGENT CPU1 HAS BEEN UNLINKED FOR AT LEAST 10 MINUTES
</scope>
<parameter name="Subject">
<value>Agent CPU1 has been unlinked for at least 10 minutes</value>
</parameter>
<parameter name="To">
<value>chuck.derry@mycorp.com</value>
</parameter>
<parameter name="Body">
<value>The cause seems to be: %{WSevent.UnlinkReason}</value>
</parameter>
</action>
</eventRule>
</eventRuleSet>
Event rule definition for scenario #3
When
file daytransac
is created in the SFoperation
directory
in workstation system1
, and modifications to the
file have terminated, submit the calmonthlyrev
job
stream.
The event rule is valid year-round in the 18:00-22:00 EST time window.
<?xml version="1.0"?>
<eventRuleSet xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="http://www.ibm.com/xmlns/prod/tws/1.0/event-management/rules"
xsi:schemaLocation="http://www.ibm.com/xmlns/prod/tws/1.0/
event-management/rules/EventRules.xsd">
<eventRule name="scenario3_rule"
ruleType="filter"
isDraft="no">
<description>This is the definition for scenario3</description>
<timeZone>America/Louisville</timeZone>
<validity from="2015-01-01" to="2015-12-31" />
<activeTime start="18:00:00" end="22:00:00" />
<eventCondition eventProvider="FileMonitor"
eventType="ModificationCompleted">
<filteringPredicate>
<attributeFilter name="FileName" operator="eq">
<value>daytransac</value>
</attributeFilter>
<attributeFilter name="Workstation" operator="eq">
<value>EVIAN1</value>
</attributeFilter>
</filteringPredicate>
</eventCondition>
<action actionProvider="TWSAction"
actionType="sbs"
responseType="onDetection">
<description>Submit the calmonthlyrev job stream.</description>
<parameter name="JobStreamName">
<value>calmonthlyrev</value>
</parameter>
<parameter name="JobStreamWorkstationName">
<value>act5cpu</value>
</parameter>
</action>
</eventRule>
</eventRuleSet>
Event rule definition for scenario #4
When
the job-x=exec
event and the job-x=succ/abend
event
are received in 500 seconds, the scheduler should
reply Yes
to prompt-1
and start
the jobstream-z
job stream, otherwise it should send
an email to twsoper@mycompany.com
alerting that the
job is late.
<?xml version="1.0"?>
<eventRuleSet xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="http://www.ibm.com/xmlns/prod/tws/1.0/event-management/rules"
xsi:schemaLocation="http://www.ibm.com/xmlns/prod/tws/1.0/
event-management/rules/EventRules.xsd">
<eventRule name="scenario4_rule"
ruleType="sequence"
isDraft="yes">
<description>This is the definition for scenario4</description>
<timeZone>America/Buenos_Aires</timeZone>
<timeInterval amount="500" unit="seconds" />
<eventCondition eventProvider="TWSObjectsMonitor"
eventType="JobStatusChanged">
<filteringPredicate>
<attributeFilter name="JobName" operator="eq">
<value>job-x</value>
</attributeFilter>
<attributeFilter name="InternalStatus" operator="eq">
<value>EXEC</value>
</attributeFilter>
</filteringPredicate>
</eventCondition>
<eventCondition eventProvider="TWSObjectsMonitor"
eventType="JobStatusChanged">
<filteringPredicate>
<attributeFilter name="JobName" operator="eq">
<value>job-x</value>
</attributeFilter>
<attributeFilter name="InternalStatus" operator="eq">
<value>ABEND</value>
<value>SUCC</value>
</attributeFilter>
</filteringPredicate>
</eventCondition>
<action actionProvider="MailSender"
actionType="SendMail"
responseType="onTimeOut">
<description>Send email to operator saying that job-x
is late</description>
<parameter name="To">
<value>twsoper@mycorp.com</value>
</parameter>
<parameter name="Subject">
<value>Job-x is late by at least 5 minutes</value>
</parameter>
</action>
<action actionProvider="TWSAction"
actionType="Reply"
responseType="onDetection">
<description>Reply Yes to prompt-1</description>
<parameter name="PromptName">
<value>prompt-1</value>
</parameter>
<parameter name="PromptAnswer">
<value>Yes</value>
</parameter>
</action>
<action actionProvider="TWSAction"
actionType="sbs"
responseType="onDetection">
<description>Submit jobstream-z</description>
<parameter name="JobStreamName">
<value>jobstream-z</value>
</parameter>
<parameter name="JobStreamWorkstationName">
<value>act23cpu</value>
</parameter>
</action>
</eventRule>
</eventRuleSet>
Event rule definition for scenario #5
Monitor the status of HCL Workload Automation processes listed in ProcessName and run the RUNCMDFM.BAT batch script located in E:\production\eventRules.
The TWSPATH keyword indicates the fully qualified path where the monitored HCL Workload Automation instance is installed, including the /TWS suffix.
On Windows operating systems, the event rule is triggered every time the agent is stopped using the ShutDownLwa command and every time the agent is stopped manually. On UNIX operating systems, the event rule is triggered when you stop the process manually, while it is not triggered by the ShutDownLwa command.
If you specify ProcessName=agent, the agent component is monitored, while the TWS JobManager process is not monitored.
<?xml version="1.0"?>
<eventRuleSet xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="http://www.ibm.com/xmlns/prod/tws/1.0/event-management/rules"
xsi:schemaLocation="http://www.ibm.com/xmlns/prod/tws/1.0/
event-management/rules/EventRules.xsd">
<eventRule name="scenario5rule" ruleType="filter" isDraft="no">
<eventCondition name="twsProcMonEvt1"
eventProvider="TWSApplicationMonitor"
eventType="TWSProcessMonitor">
<scope>
AGENT, NETMAN DOWN ON WIN86MAS
</scope>
<filteringPredicate>
<attributeFilter name="ProcessName" operator="eq">
<value>agent</value>
<value>appservman</value>
<value>batchman</value>
<value>jobman</value>
<value>mailman</value>
<value>monman</value>
<value>netman</value>
</attributeFilter>
<attributeFilter name="TWSPath" operator="eq">
<value>E:\Program Files\HCL\TWA\TWS</value>
</attributeFilter>
<attributeFilter name="Workstation" operator="eq">
<value>win86mas</value>
</attributeFilter>
<attributeFilter name="SampleInterval" operator="eq">
<value>5</value>
</attributeFilter>
</filteringPredicate>
</eventCondition>
<action actionProvider="GenericActionPlugin" actionType="RunCommand"
responseType="onDetection">
<scope>
RUNCMDFM.BAT
</scope>
<parameter name="Command">
<value>runCmdFM.bat</value>
</parameter>
<parameter name="WorkingDir">
<value>E:\production\eventRules</value>
</parameter>
</action>
</eventRule>
</eventRuleSet>
Event rule definition for scenario #7
Monitor the Symphony file status in the IT041866-9088 workstation and logs the occurrence of a corrupt Symphony record in the internal auditing log database.
In each workstation, the Batchman process monitors the Symphony file. When it detects a corrupt record, it send the corruption event to the Monman process message queue and then to Event Processor in the Master workstation.
The event rule is triggered every time the Batchman process finds a corrupt dependency record in the workstation specified in the event rule definition.
If you set the workstation value to IT041866-9088, the Symphony file on this workstation is monitored, and the event rule is triggered when the Batchman process on this workstation detects a corrupt record in the Symphony file.
The occurrence of the corrupt record is written to the Messagge logger audit file.
?xml version="1.0"?>
<eventRuleSet xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="http://www.ibm.com/xmlns/prod/tws/1.0/event-management/rules"
xsi:schemaLocation="http://www.ibm.com/xmlns/prod/tws/1.0/event-management/rules
http://www.ibm.com/xmlns/prod/tws/1.0/event-management/rules/EventRules.xsd">
<eventRule name="TEST1" ruleType="filter" isDraft="no">
<eventCondition name="productAlertEvt1" eventProvider="TWSObjectsMonitor"
eventType="ProductAlert">
<scope>
IT041866-9088
</scope>
<filteringPredicate>
<attributeFilter name="Workstation" operator="eq">
<value>IT041866-9088</value>
</attributeFilter>
</filteringPredicate>
</eventCondition>
<action actionProvider="MessageLogger" actionType="MSGLOG"
responseType="onDetection">
<scope>
OBJECT=%{PRODUCTALERTEVT1.WORKSTATION} MESSAGE=%{PRODUCTALERTEVT1.WORKSTATION}
corruption
</scope>
<parameter name="ObjectKey">
<value>%{productAlertEvt1.Workstation}</value>
</parameter>
<parameter name="Message">
<value>%{productAlertEvt1.Workstation} corruption</value>
</parameter>
<parameter name="Severity">
<value>Info</value>
</parameter>
</action>
</eventRule>
</eventRuleSet>