"Excluded Objects" syntax in OEM

From: Herring, David <"Herring,>
Date: Thu, 27 Feb 2020 17:51:18 +0000
Message-ID: <BY5PR02MB6660F4536D949DBCF0A6EA14D4EB0_at_BY5PR02MB6660.namprd02.prod.outlook.com>



Folks,

I'm trying to figure out what the proper syntax is for having particular ORA- errors to be excluded from Incident Rules and not having much luck. I could have sworn that in the past regular expressions worked but now I'm doubting it. This is for OEM 13.3, RHEL 6.9.

(Note: I've got an SR open w/ Oracle on this as well but thought I'd check with this list as you tend to have more real-world examples to work off of)

As a completely contrived example to help explain what I'm trying to do, let's say I have Incident Rule named "DB_INST_RS" and is based on target type "Database Instance". We have an instance that is generating a lot of "ORA-12345: Made up error [abcd efgh]" errors and we want to exclude those errors from this Incident Rule. We are getting email alerts that show the following fields and values:

Event Type=Metric Alert
Event name=adrAlertLogIncidentError:genericIncidentErrStack Metric Group=Incident
Metric=Generic Incident

... so we know that within the Incident Rule we should be editing metric "Generic Incident" and put something in the "Excluded Objects" field but we're unsure of the syntax rules for strings in this field. Does it work on regular expressions and if so, should ".*ORA-12345.*abcd.*" work? Should we be putting in the error arguments in this field, like "abcd,efgh"?

I should be able to tell what works and what doesn't by running a rule simulation for the given target and found Incidents but the problem is the simulation ends with saying it'll raise an alert on the errors, which we don't want. Either I've got the syntax wrong or I'm misunderstanding what can be placed in the "Excluded Objects" field.

I do realize I could try suppressing the error under Incident Manager but I feel that method would be tough to detect it being in place, as in there isn't a built-in menu choice for displaying suppressed Incidents - I'd have to create a custom view for that.

Regards,

Dave

--
http://www.freelists.org/webpage/oracle-l
Received on Thu Feb 27 2020 - 18:51:18 CET

Original text of this message