Event Integration From 3rd-party Monitoring Tools - Part 5: Msend API mapping and conversion

In your 3rd-party monitoring software, each event (also called alert) contains many different fields (also called attributes).  You need to map those field names to BPPM cell slot names in order to pass those field values into BPPM cell. 

First, you need to decide what BPPM cell class you want to map to.  You can map to base class EVENT or an existing subclass of EVENT such as PATROL_EV.  Or, you can define your own class.  I personally prefer to define a specific class for each 3rd-party monitoring software regardless if I need to add extra slots to it or not.  For example, I have defined SCOM_EV for events from Microsoft SCOM and NAGIOS_EV for events from Open Source tool Nagios.

Second, you need to decide what slots in BPPM cell need to be mapped.  Each event in BPPM cell has more than 75 slots.  Obviously you don't need map all 75 slots.  If you will send emails for some events, the slots referenced in your email will need to be mapped.  If you will create incident tickets from some events, the slots that map to your ticketing system will need to be mapped from your 3rd-party monitoring software.  If you have a NOC team that watches BPPM GUI to help create and escalate tickets, the slots your NOC team can see will need to be mapped. Commonly mapped BPPM cell slots include mc_host, mc_object_class, mc_object, mc_tool_class, mc_tool_key, mc_parameter, mc_parameter_value, severity, mc_priority, and msg.

Third, you need to decide how to map. For most of BPPM cell slots, you can map directly.  For example, you can use mc_host=${HOSTNAME} to map HOSTNAME field from your 3rd-party monitoring software directly to BPPM cell slot mc_host.  However for some slots in BPPM cell, especially the ones in enumerable type, you may need to perform value conversion unless BPPM cell and your 3rd-party monitoring software use exactly the same spelling for all their values. For example, if your 3rd-party monitoring software uses high, medium, and low as the value of event priority, but BPPM cell uses PRIORITY_1 to PRIORITY_5 as the values of events priority, you would need to convert the values in your 3rd-party monitoring software to the values in BPPM cell.

You can perform conversion in your OS script. Or you can map the conversion-required fields to other string-typed BPPM slots 'as is'.  Then you can create a MRL rule in BPPM cell to perform the conversion.  In the above example, you can create a new BPPM cell slot called priority_string to map priority field from your 3rd-party monitoring software.  Then in your MRL rule, you can convert value in priority_string slot to mc_priority slot.  By performing conversion in BPPM cell, you can take advantage of dynamic tables to make value conversion easy to code and easy to maintain.