haveSituationClsChanged

A Workflow Engine function that detects whether the CIs within a Situation changed when an alert is added to the Situation (manually, from a Sigaliser, or via APIs).

A CI is defined by the source (host) of the alert. This function is case insensitive; for example, “HOST123” is considered the same as “host123”. However, it does not account for FQDNs; “host123.domain.com“ is not considered equal to “host123”, for example.

CI delta detection uses a hashing mechanism where the data is stored in the Situation Correlation info. However, the list of current CIs is not stored in the Situation object itself to prevent oversized objects and UI pollution associated with long lists. If needed, you can retrieve and reset the current hash value using the Graze getSigCorrelationInfo and removeSigCorrelationInfo API calls.

If a new CI is detected, the function returns true and additionally pushes the list of new CIs into the workflowContext subsequent actions in the workflow.

The workflowContext.newCIs array contains a list of the new hosts. If a single alert is added, the list will have a single entry. If multiple CIs are added, the list will contain multiple entries. Subsequent actions need to cater for single and multiple entry lists.

The haveSituationClsChanged function should be preceded in the workflow by the sigActionFilter action with the actionTypes argument set to include either “Added Alerts To Situation” or “Manually added Alert to Situation” depending on the desired use case.

This function is available as a feature of the Add-ons v2.2 download and later.

This function is available for Situation workflows only.

Back to Workflow Engine Functions Reference.

Arguments

Workflow Engine function haveSituationClsChanged has no arguments.

Example

Given a situation with 3 alerts from 3 different hosts:

alert1 : host123
alert2 : host456
alert3 : host789

if a new alert was added to the situation:

alert4 : host123

The situationCisChanged returns false since host123 in the new alert is not a new CI. If alert5 was added as follows:

alert 5 : host2020

haveSituationClsChanged returns true and the workflowContext would contain an array (list) containing the new host:

{ 
  "newCIs" : [ 
    "host2020"
  ]
}

Note

The workflowContext.newCIs object is a JS array, any subsequent actions need to understand how to manage this data.

How to use the situationCIsChanged in a workflow

A specific Situation action message (“Added Alerts To Situation” or “Moved Alerts To Situation” or “Manually added Alert to Situation” ) drives the haveSituationClsChanged function.

Ensure there is a Situation Action engine that is standalone which does not process output of any other moolet and has an event hander of “SIgAction”:

{
    name            : "Situation Delta",
    classname       : "com.moogsoft.farmd.moolet.workflowengine.CWorkflowEngine",
    run_on_startup  : true,
    metric_path_moolet : true,
    moobot          : [ "WorkflowEngine.js", "SituationDeltaWorkflows.js" ],
	event_handlers : [ "SigAction" ],
	standalone_moolet : true,
    message_type: "situation"
}

The sigActionFilter action must precede the situationCIsChanged function with one more more of the triggering messages. For example:

Warning

When alerts are added manually to Situations, both the “Added Alerts To Situation” and “Manually added Alert to Situation” Situation action messages are emitted. Therefore, you should not list both. Only list these messages separately if there is a different subsequent action. For example, take an action if an alert is added to any Situation regardless of the method, but do something explicit when the alert is added manually.

In this section: