Pattern Matching

TelAlert has long included various administrative commands that can be used to view, manage, and modify alerts in progress. These include -

show

, -

clear

, -

nak

, and -

ack

, just to name a few.

These commands can be used with an Alert ID to act on a specific alert, or they can be used with various command line options to act on alerts that meet specified criteria. For example, you can use these command—

telalert -show -source remedy telalert -show -source openview

—to specify that the command be executed against only those alerts that have a particular –

source

string associated with them.

Beginning with TelAlert 5.4, you have much greater flexibility in specifying what alerts are acted on by administrative commands. This flexibility is based on an entirely new section, called [

Patterns

], which has been added to the configuration file.

Pattern-matching provides support for a wide range of Boolean and wildcard expressions. For example, you can combine the two commands presented above into a single command:

telalert -show -selectpe source "remedy|openview"

-selectpe

means “select pattern expression.” You can specify alerts according to message content:

telalert -show -selectpe mdefault "printer.*(down|dead)"

This translates into “show all alerts that contain the word printer and either the word down or the word dead.” You can create expressions that include unlike criteria:

telalert -show -selectpe user tom -selectpe mdefault help

This translates into “show all alerts that are (1) associated with the user Tom and (2) contain the word help in the message.” By default, multiple

–selectpe

clauses are joined with a logical AND.

You can override this default with the

–selectpm

option, which means “select pattern match.” By adding this—

-selectpm "!user & mdefault"

—to the end of the above command line, you would be specifying those alerts that contain the word help and are not associated with the user Tom.

10.10.1 Other Uses

There are several other command-line options available as part of TelAlert 5.4’s pattern-matching functionality. These are designed to allow you to use it with the elimination of duplicate messages, filtering, and the automatic cancellation of unwanted messages.

-checkpe

The

–checkpe

operator is used to compare a new message against messages already in the TelAlert queue. Where previously, you might have used:

telalert -i foo -m foo -check printer is down

to prevent duplicate messages being issued with the exact check sequence specified, the

-checkpe

option provides much more flexibility:

telalert -i foo -m foo -checkpe mdefault "printer.*down"

This command checks for messages that contain the string

printer

followed by zero or more characters followed by the string

down

.

A more complex example could be:

telalert -i foo -m foo -checkpe mdefault "printer.*(down|dead)"

This command checks for messages that contain the string

printer

followed by zero or more characters followed either by the string

down

or the string

dead

.

-filterpe

A -

filterpattern

is used in conjunction with -

i/-g/-l/-c/-cpl

and

-mto

filter messages.

The pattern expressions are applied to the command line parameters specified with

–I

and

-m

. If the match expression is true, the message is filtered.

For example, to filter out automatically generated "Node Down" messages that contain references to Printers:

telalert -i someone -m Node $2 Down -filterpe mdefault "printer"

will filter (skip) any message with the text "printer" in it.

-cancelpe

A –

cancelpattern

is used in conjunction with -

i/-g/-l/-c/-cpl

and

-m

to cancel the new message if a matching message is found. The pattern expressions are applied to existing Alerts; if the match expression is true for an Alert, the Alert is cleared. The new message is dropped if any Alert that was cleared had status SS_Delayed. The new message is also dropped if no Alert matched and the

-cancelnc

option as specified.

10.10.2 Pre-Defining Regular Expressions

Since compilation of regular expressions (RE) can be expensive, and the possible combination of options can be complex, it’s possible to predefine them in the [

Patterns

] section.

A simple pattern to match entries with Configuration names containing "Sky" (case-insensitive) could be:

{ConfSky}

PEConfiguration=’Sky’

Match=PEConfiguration

A simple string like this is treated as though it had been specified as

".*Sky.*"

, meaning "

0 or more characters, ’sky’, 0 or more characters

".

To use this to show active sends to SkyTel (assuming that all SkyTel Configurations’ names contain

"

Sky

"), use:

telalert -show -selectpattern confsky

The following pattern additionally filters out entries with a user value other than

".*Ross.*"

{ConfSkyUserNotRoss}

PEConfiguration=’Sky’

PEUser=’Ross’

Match=PEConfiguration & !PEUser

These same tests can be implemented using adhoc patterns specified on the command line, such as the following:

telalert -show -selectpe configuration "sky"

and:

telalert -show -selectpe configuration "sky" \-selectpe user "ross"

\-selectpm "configuration & !user"

11

Setting Up and Applying Schedules

11.1 Overview

Instructions for using [Schedule] definitions to specify the times when destinations are valid for sending notifications.

11.2 Getting Started

11.2.1 What are Schedules?

[Schedule]

definitions, like

[Filter]

definitions, are a means of qualifying destinations. If a destination is associated with a

[Filter]

definition, TelAlert understands the conditions under which it can and cannot send a message to this destination—conditions determined by the tags accompanying the message and the rules comprising the

[Filter]

definition. Similarly, if a destination is associated with a schedule, TelAlert understands the times during which it can and cannot send a message to this destination—times determined by the associated schedule and—

optionally—the priority of the message.

At its most basic, deploying a schedule involves associating a

[Schedule]

definition with a destination and letting TelAlert send or not send to the destination according to whether the destination is on duty at the time.

Commonly, however, schedules are used in conjunction with groups or users, as well as with priority settings assigned to individual messages. In the first case, a schedule might be used to qualify the destinations comprising a group, so that those that are on duty are automatically distinguished from those that are not. In the second, a schedule is associated with one or more destinations by referring to it in a

[User]

definition and then invoking the

[User]

definition in the relevant destinations. Priority settings allow you to invoke alternate

[Schedule]

definitions that extend a regular schedule’s hours for messages of a certain degree of importance; you can also ensure that extremely urgent messages are sent, without regard for any schedule.

11.2.2 Needed Information

To set up schedules, you simply need to know the on-duty hours for each of the destinations to which you want a schedule to apply. You can also include information about vacations and holidays, extra duty times, and the circumstances under which you would like a message to be sent even during off-duty hours.

11.2.3 Other Considerations

TelAdmin vs. telalert.ini File Configuration

To set up scheduling, you can use TelAdmin (now a component of the TelAlert Desktop) or edit the telalert.ini file directly. As a rule, the Administrator Guide seeks to provide method-neutral

documentation: thus, the instructions offered here apply equally to all methods.

For detailed information on these two configuration options, including important differences between the two, refer to the TelAlert Desktop Guide.

In document TelAlert UMS Administrator Guide (Page 185-190)