How to... Enable RBA for all devices in one organization?
When creating automation policy, there is an option for selecting the Organization for where it "belongs", but still one needs to select devices from the device list, otherwise there is "no devices in organization" in Aligned Devices list. What about the situation where the device list can be pretty dynamic, like clouds. So devices come and go? Is the official method then to use device groups for that kind of alignment? Or are there other ways to enable RBA for organization's all devices.
Updates to EM7_RESULT handling?
Hi, During SL1 version update we have noticed that EM7_RESULT variable is going to be re-formatted to different type during snippet execution. For example if we populate the variable with list and with tuple elements, the variable is getting re-formatted to nested list. For example EM7_RESULT = [("test1", "test2")], is re-formatted after snippet execution to [["test1", test2"]] format. Is this change documented somewhere and in which version this update was implemented?
ServiceNow Incident Sync Pack & RBAs
Hi all, I am currently trying to configure some Run book automation policies to enrich data in ServiceNow incidents, sending the RBA output into the Incident worklog, and have hit a bit of a road block on the best way to configure the RBA criteria. Background: We use a dedicated "ServiceNow: [Incident] - Add/Update" RBA for each organisation, which is triggered on event creation, to effectively "Auto Ticket" on all events for specific SL orgs (excluding masked and child rollup). Challenge: In my Enrichment RBA's I want to trigger using "and external ticket IS created", to ensure that I am only posting updates when there has been a ServiceNow incident created. However the OOTB ServiceNow Incident sync pack is updating the events external ticket ref field with various messages e.g. "Sync Successful", before the event is updated with the Incident Number. As soon as the Incident Create updates the events external ticket ref field, by Automation policy gets triggered (I assume because from the RBA's point of view, it has a value in the field) to update the Worklog. Does anyone have any suggestions on the best way to ensure that an "Enrichment" RBA is only triggered only once it has a real SN incident number returned? Many thanks in advance. Neil
Heartbeats Monitoring - suggestion
Hello, One of our customer is using a lot of Custom Scripts, where we are monitoring their output by syslog. There is starting a problem, when script stuck or block. Then customer don't know about it. Is there any possibilities how to monitor, If these scripts are working? We have suggestion, that Custom Scripts can send also message like OK or KO. 2 Events will match these both. There should be an action (run book) for script is running like: em7_snippets.generate_alert(xtype = 1, xid=EM7_VALUES['%x'], message = 'script heartbeat') and not running with count like: if EM7_VALUES['%c'] >= 2: em7_snippets.generate_alert(xtype = 1, xid=EM7_VALUES['%x'], message = 'script is not running') There will be also 2 automation. For script heartbeat will be action for heartbeat every 5min (for example as schedules) and for some Device group. Second automation for not running will have action not running. I think, there will must be next two events which will be matched by "script heartbeat or script is not running". Also if new syslog message will come, the first events (mentioned above) will must clear these events for continue with actions and automatons. Do you think that it is possible to implement it? How will look Hardware usage when we will have more automations/actions or when we will have it on lot of devices? Do you think that it is construable? Thank you for your answers.
