Hi All,
Is it possible to set up a correlation rule that will send me an email notification whenever a new service or element is added or removed from the system? I would like the email to contain the name of the service/element as well as the user who made the change. Can this be done?
Can you tell me how implementing this check will affect the system load?
Thanks
Simone
Hi Simone,
While the answer provided by Miguel, is the correct approach, for me that didn't work.
As an alternative I changed my filter, to filter out the correct information events using a regex.
Please find the full example below:
Hi Simone,
Yes, you could create a correlation rule that can be triggered whenever a new element/service is created. When configuring the correlation rule, please select the option 'Show Details -> Accept Information Events'.
In the alarm filter section you could define an alarm filter that matches the event generated. For example, when an element is created you will see the following information event:
Then, you could set the alarm filter as follows:
Since your correlation rule is working based on information events, you will need to enable the option 'Trigger on single events'
For services your will need to change the parameter from 'Element created' to 'Service added'
Regarding the user, as you can see in the screenshot with the information events, the name of the user that performed the action is available in the column 'Value'. Using Script Condition Functions you can pass the column 'Value' of the information event to the email notification.
Hope it helps.