3. OASE¶
3.1. Introduction¶
3.3. OASE procedure¶
3.3.1. OASE workflow¶
Workflow details and references
- Register filterFrom the Filter menu in the "Rule" menu group, register filters that configures label conditions used by rules.For more information, see Filter.
- Register ActionFrom the Action menu in the "Rule" menu group, register an action that will be executed when a rule is matched.For more information, see Action.
- Register rulesFrom the Rule menu in the "Rule" menu group, register an action that configures rule evaluation conditions and what actions are executed.For more information, see Rule.
3.4. OASE menu operation¶
3.4.2. Event flow¶
図 3.73 Submenu (Event flow)¶
図 3.74 Using Event flow¶
注釈
RAW Event data¶
図 3.75 RAW Event data (Event flow)¶
Selecting Display pattern¶
図 3.76 Select Display pattern (Event flow)¶
Item |
Description |
|---|---|
New event |
Status when the event is collected but not detected by the evaluation function.
When the evaluation time ends, it will change to Known (evaluated), Unknown or Expired.
|
Known event |
Events that has been detected by the evaluation function. |
Unknown event |
Events that could not be singled out by the filter function (was not detected by the evaluation function).※
If the event is unkown, the user should consider what to do with it as an evaluation target.
|
Expired event |
Event removed from evaluation targets caused by one of the following reasons.
・The event period has exceeded more than double the TTL period and is therefore deemed as being too old.
・The event could not be matched between the end of the TIL period and before the evaluation period.
|
Conclusion event |
Event that will occur when a rule is matched. |
Execution Action |
Displays the information of the action that will be executed when a rule is matched. |
Rule |
Displays Rule ID and Rule name. |
Assigned label value |
Set fixing point |
Description |
|---|---|---|
RESPONSE_KEY not found |
Response key |
Adds a label if the specified key does not exist in any events. |
RESPONSE_LIST_FLAG is incorrect.(Not Dict Type)
RESPONSE_LIST_FLAG is incorrect.(Not List Type)
|
Response list flag |
Adds a label if "False" is selected in the settings while the actual values are in a list.
Adds a label if "True" is selected in the settings while the actual values are not in a list.
|
EVENT_ID_KEY not found |
Event ID key |
Adds a label if a non-existent key is specified to the data the corresponds to the Event's "Response key". |
Time range specification¶
図 3.77 Specifying range (Event flow)¶
図 3.78 Specifying time (Event flow)¶
Operating the Event flow menu¶
図 3.79 Drag and drop (Event flow)¶
Filter¶
図 3.80 Filter input (Event flow)¶
Action¶
図 3.81 Action input (Event flow)¶
Rule¶
図 3.82 Rule input (Event flow)¶
3.4.3. Event history¶
- In the menu, users can view a list of events fetched by the Agent.
図 3.83 Submenu (Event history)¶
- The items found in the Event history menu are as following.
Item |
Description |
|---|---|
Object ID |
Automatically given by the system and cannot be edited. |
Event collection settings ID |
[Source data] OASE management/Event collection/Event collection settings ID |
Event collection time |
The date/time of when the Agent fetched the Event. |
Event valid time |
The time period in which the event is valid. |
Event status |
The following statuses exists.
・Reviewing
・Unknown
・Evaluated
・Expired
|
Event type |
The following statuses exists.
・Event
・Conclusion event
|
Label |
Information regarding the attached label. |
Evaluation rule name |
[Source data]
OASE/Rule/Rule label name
|
Used event |
Event use for evaluation. |
3.4.4. Create label¶
- In the menu, users can maintain (view/register/edit/discard) labels.
図 3.84 Submenu (Create label)¶
- The input items found in the Create label menu are as following.
Item |
Description |
Input required |
Input method |
Restrictions |
|---|---|---|---|---|
Label key |
The Label key can contain half width alphanumeric chatacters and the following symbols: (_-).
The key can not start with a symbol.
|
〇 |
Manual |
Maximum length 255 bytes |
Colour code |
Decides the colour of the label when displayed in the Event flow menu.
Not configuring anything will give the label a colour by default.
|
ー |
Manual |
Maximum length 40 bytes |
Remarks |
Free description field. Can also be used for discarded and restored records. |
ー |
Manual |
Maximum length 4000 bytes |
3.4.5. Labeling¶
- In the menu, users can link(view/register/edit/discard) Event collection targets, Labeling conditions and the corresponding labels.
図 3.85 Submenu (Labeling)¶
- The input items found in the Labeling menu are as following.
Value data type |
Comparison method |
Comparing value |
|---|---|---|
String |
RegExp、RegExp(DOTALL)、
Everything but RegExp(MULTILINE)
|
ー
E.g. sample
|
Integer |
RegExp、RegExp(DOTALL)、
Everything but RegExp(MULTILINE)
|
ー
E.g. 10
|
Float |
RegExp、RegExp(DOTALL)、
Everything but RegExp(MULTILINE)
|
ー
E.g. 1.1
|
Boolean |
== (Match) , ≠Mismatch) only |
true, false only (Can contain capitalized letters) |
Object |
== (Match) , ≠Mismatch) only |
Enclose with {}.
E.g. {Key: Value}
|
Array |
== (Match) , ≠Mismatch) only |
Enclose with [].
E.g. [aa, bb, cc]
|
Null |
== (Match) , ≠Mismatch) only |
Null string、[]、{}、0、False only
E.g. ""
|
Other |
RegExp、RegExp(DOTALL)、
RegExp(MULTILINE) only
|
ー |
Comparison method | Description |
|
|---|---|
RegExp |
Regular expression without any options. |
RegExp(DOTALL) |
If this options is not used, all characters that does not include newlines will be used. |
RegExp(MULTILINE) |
Can match everything that starts and ends with "^" or "$". |
3.4.6. Filter¶
- In the menu, users can maintain (view/register/edit/discard) filters.
図 3.86 Submenu (Filter)¶
- The input items foud in the Filter page are as following.
Item |
Description |
Input required |
Input method |
Restrictions |
|---|---|---|---|---|
Active |
Select whether to activate or deactivate the filter.
True：Actived
False：Deactivated
|
〇 |
List selection |
ー |
Filter name |
Input a name for the filter. |
〇 |
Manual |
Maximum length 255 bytes |
Filter conditions |
Opens a window where userse can configure filter conditions. |
〇 |
ー |
ー |
Search method |
Select a method for searching for labels.
Unique：Can only filter unique events. If multiple events are hit, all events will be processed as unknown events.
Queuing：Can filter unique events, but uses the oldest event if multiple are hit. Note that they might match the rules multiple times.
|
〇 |
Manual |
ー |
Remarks |
Free description field. Can also be used for discarded and restored records. |
ー |
Manual |
Maximum length 4000 bytes |
Click the Filter conditions field to open up a window where the user can configure filter conditions.
図 3.87 Filter condition settings¶
- The items found in the Filter condition window are as following.
Item |
Description |
Input required |
Input method |
Restrictions |
|---|---|---|---|---|
Label key |
Select a label key registered in the Create label menu or one of the following keys.
・_exastro_event_collection_settings_id
・_exastro_fetched_time
・_exastro_end_time
・_exastro_type
・_exastro_host
|
〇 |
List selection |
ー |
Condition |
Select one of the following: == (Match) ,≠ (Mismatch) |
〇 |
List selection |
ー |
Condition value |
Input a value that will be configured to the label key. |
〇 |
Manual |
Maximum length 4000 bytes |
3.4.7. Action¶
- In the menu, the user can maintain (view/register/edit/discard) Actions.
図 3.88 Submenu (Action)¶
- The input items found in the Action menu are as following.
Item |
Description |
Input required |
Input method |
Restrictions |
|---|---|---|---|---|
Action name |
Input a name for the Action. |
〇 |
Manual |
Maximum length 255 bytes |
Conductor name |
[Source data]
Conductor/Conductor list/Conductor name
|
〇 |
List selection |
ー |
Operation name |
[Source data]
Basic console/Operation list/Operation name
|
〇 |
List selection |
ー |
Event link (Host) |
Select whether to specify the original event label "_exastro_host" as a target host for the Action or not. |
〇 |
List selection |
Default value：False |
Specify (Host) |
Select the Action target host.
[Source data]
Ansible common/Device list/Host name
|
ー |
List selection |
ー |
Parameter sheet |
Select the Parameter sheet that the Action will use.
[Source data]
Parameter sheet(Input)/Parameter sheet name(ja)
|
ー |
List selection |
ー |
Remarks |
Free description field. Can also be used for discarded and restored records. |
ー |
Manual |
Maximum length 4000 bytes |
Tip
3.4.8. Rule¶
- In the menu, users can maintain (view/register/edit/discard) Rules.
図 3.89 Submenu (Rule)¶
- The input items found in the Rule menu are as following.
Item |
Description |
Input required |
Input method |
Restrictions |
|---|---|---|---|---|
Active |
Select whether to activate the Filter or not.
True：Activated
False：Deactivated
|
〇 |
List selection |
ー |
Rule name |
Input a name for the Rule. |
〇 |
Manual |
Maximum length 255 bytes |
Rule label name |
Input a name that will be configured to the "_exastro_rule_name" used to permanently evaluate what rule the created the Conclusion event.
|
〇 |
Manual |
Maximum length 255 bytes
※This can not be changed later.
|
Priority |
Input a valid integer for the Priority.
The smaller number will be prioritized.
|
〇 |
Manual |
Maximum length 255 bytes |
Filter A |
[Source data]
OASE/Rule/Filter/Filter ID
|
〇 |
List selection |
ー |
Filter operator |
Select a filter operator.
A and B： Matching with both A and B
A or B：Matching with either A or B
A -> B：Matching when B happens after A.
|
〇 |
List selection |
ー |
Filter B |
[Source data]
OASE/Rule/Filter/Filter ID
|
ー |
List selection |
ー |
Pre-notification |
ー |
Select file |
Maximum size2Mb
※1
|
|
Not yet supported |
※Planned to be released in later versions. |
ー |
ー |
ー |
Pre-notification destination |
Select a destination for where the notifications will be sent. |
ー |
List selection |
ー |
Action name |
[Source data]
OASE/Action/Action name
|
ー |
List selection |
ー |
Post-operation notification |
ー |
Select file |
Maximum size2Mb
※1
|
|
Not yet supported |
※Planned to be released in later versions. |
ー |
ー |
ー |
Post-operation notification destination |
Select a destination for where the notifications will be sent. |
ー |
List selection |
ー |
Action (Inheriting original event label) |
Select whether the original event label used by the rule should be used as an Action parameter or not. |
ー |
List selection |
Default value：True |
Conclusion event (Inheriting original event label) |
Select whether the original event label used by the rule should inherit the Conclusion event or not. |
ー |
List selection |
Default value：False |
Conclusion label settings |
Opens the Window that allows users to configure Labels for Conclusion events. |
〇 |
List selection |
ー |
TTL |
TTL (Time To Live) is how long an event is handled as a rule evaluation target (in seconds).
|
〇 |
Manual |
Minimum value 10 (Seconds)
Maximum value 2147483647 (Seconds)
Default value：3600 (Seconds)
|
Remarks |
Free description field. Can also be used for discarded and restored records. |
ー |
Manual |
Maximum length 4000 bytes |
Click the Conclusion label settings field to open up a window where the user can configure Conclusion label settings.
図 3.90 Conclusion label settings¶
- The Conclusion label's input items are as following.
Item |
Description |
Input required |
Input method |
Restrictions |
|---|---|---|---|---|
Conclusion label key |
Select a label key registered in the Create label menu or the following key.
・_exastro_host
|
〇 |
List selection |
ー |
Conclusion label value |
Input a value that will be configured to the Conclusion label key. |
〇 |
Manual |
Maximum length 4000 bytes |
3.4.9. Evaluation results¶
- In the menu, users can view Evaluation results.
図 3.91 Submenu (Evaluation results)¶
- The items found in the Evaluation results menu are as following.The user can press the Details button to move to the menu where they can see detailed information regarding the execution status.
Item |
Description |
|---|---|
Action history ID |
The Label key can contain half width alphanumeric chatacters and the following symbols: (_-). |
Rule ID |
[Source data]
OASE/Rule/Rule ID
|
Rule name |
[Source data]
OASE/Rule/Rule name
|
Status |
The following statuses exists.
・Evaluated.
・Executing
・Waiting for approval
・Approved
・Denied
・Completed
・Completed (Error)
・Waiting for confirmation
・Confirmed
・Confirmation denied
|
Action ID |
[Source data]
OASEAction Action ID
|
Action name |
[Source data]
OASEAction Action name
|
Conductor instance ID |
[Source data]
Conductor/Conductor history/Conductor instance ID
|
Conductor name |
[Source data]
Conductor/Conductor history/Conductor name
|
Operation ID |
[Source data]
Basic console/Operation list/Operation ID
|
Operation name |
[Source data]
Basic console/Operation list/Operation name
|
Event link |
[Source data]Rule |
Specify Host ID |
[Source data]
Ansible common/Device list/Management system item number
|
Specify Host name |
[Source data]
Ansible common/Device list/Host name
|
Parameter sheet name |
[Source data]
Parameter data sheet definition list/Parameter sheet name(ja)
|
Parameter sheet (rest) |
[Source data]
Parameter sheet definition list/Parameter sheet name(rest)
|
Use event ID |
List of Event IDs leading to the Action execution. |
Action (Inheriting original event label) |
[Source data]Rule |
Event (Inheriting original event label) |
[Source data]Rule |
Action parameter |
Dispalys Parameters linked to the Action |
Conclusion event label |
Displays labels used by the Conclusion event. |
Registration date/time |
YYYY/MM/DD HH:MM:SS |
Remarks |
Free description field. Can also be used for discarded and restored records. |
3.5. Appendix¶
3.5.1. Labeling setting example¶
図 3.92 Labeling input example (Labeling)¶
3.5.2. Labeling example (regular expression)¶
Search condition |
Label |
||||
|---|---|---|---|---|---|
Mail body |
Comparison method |
Comparison value |
Key |
Value |
**Applied label (key: value) ** |
Target Server:web01.com |
RegExp |
Server:(.*).com |
Server |
ー |
Server: web01 |
・・・ (Body) Target Server:web01.com ・・・ (Body) |
RegExp(DOTALL) |
Server:(\w+).com\r\n(.*) has occured. |
Server |
\2: \1 |
Server: Fault: web01 |
Server:web01.com A fault has occured. |
RegExp(MULTILINE) |
^Server:(.*).com\r$ |
Server |
\1 |
Server: web01 |
図 3.93 Settings when using Regular expressions¶
3.5.3. Event data format sent by Agent¶
1{
2 "event": [{
3 "message_id": "<20231004071711.06338770D0A0@ita-oase-mailserver.localdomain>",
4 "envelope_from": "root@ita-oase-mailserver.localdomain",
5 "envelope_to": "user1@localhost",
6 "header_from": "<root@ita-oase-mailserver.localdomain>",
7 "header_to": "user1@localhost",
8 "mailaddr_from": "root <root@ita-oase-mailserver.localdomain>",
9 "mailaddr_to": "user1@localhost",
10 "date": "2023-10-04 16:17:10",
11 "lastchange": 1696403830.0,
12 "subject": "test mail",
13 "body": "sample\r\n"
14 "_exastro_event_collection_settings_id": "d0c9a70c-a1c0-4c7b-9e96-82e602ebc55e",
15 "_exastro_fetched_time": 1696406510,
16 "_exastro_end_time": 1696406810,
17 "_exastro_type": "event"
18 "_exastro_event_collection_settings_name": "agent01"
19 }]
20}
3.5.4. Confirmation items when Event history and Evaluation results displays large amounts of records.¶
3.5.5. Event history search method¶
- Patch match that can be used when searching
- YYYY/MM/DDYYYY/MM/DD hhYYYY/MM/DD hh:mm
- Patch match that can be used when searching (Validation error)
- If the string is not finished or the last character is a colon.YYYY/MM/DYYYY/MM/DD hYYYY/MM/DD hh:YYYY/MM/DD hh:mm:Example: 2024/09/01 12:2
- Use all characters of the Record's "Use event" value.
- Multiple items["ObjectId('xxxxxxxxxxxxxxxxxxxxxxxx')",... "ObjectId('yyyyyyyyyyyyyyyyyyyyyyyy')"]1 Item["ObjectId('xxxxxxxxxxxxxxxxxxxxxxxx')"]
- Use the contents of the Record's "Use event" value array.
- Multiple items"ObjectId('xxxxxxxxxxxxxxxxxxxxxxxx')",... "ObjectId('yyyyyyyyyyyyyyyyyyyyyyyy')"1 item"ObjectId('xxxxxxxxxxxxxxxxxxxxxxxx')"
- Use the ObjectId character string of the Record's "Use event" value.
- Multiple itemsObjectId('xxxxxxxxxxxxxxxxxxxxxxxx'),... ObjectId('yyyyyyyyyyyyyyyyyyyyyyyy')1 itemObjectId('xxxxxxxxxxxxxxxxxxxxxxxx')
- Use the value inside the ObjectID of the Record's "Use event" value.
- Multiple itemsxxxxxxxxxxxxxxxxxxxxxxxx,... yyyyyyyyyyyyyyyyyyyyyyyy1 itemxxxxxxxxxxxxxxxxxxxxxxxx'
3.5.6. Pre/Post-notification template¶
1[TITLE]
2Pre-notification
3
4[BODY]
5Event
6{%- for event in events -%}
7{%- set i = loop.index %}
8 Event source data #{{ i }}
9{%- for key, value in event._exastro_events.items() %}
10 ・{{ key }}：{{ value }}
11{%- endfor -%}
12{%- endfor %}
13 Conclusion event label ： {{ action_log.conclusion_event_labels }}
14
15Rule information
16 Matched rule ID ： {{ rule.rule_id }}
17 Matched rule name ： {{ rule.rule_name }}
18 Condition
19 Filter A
20 Filter ID ： {{ rule.filter_a }}
21 Filter name ： {{ rule.filter_a_name }}
22 Filter condition ： {{ rul e.filter_a_condition_json }}
23 Filter operator ： {{ rule.filter_operator }}
24 Filter B
25 Filter ID ： {{ rule.filter_b }}
26 Filter name ： {{ rule.filter_b_name }}
27 Filter condition ： {{ rule.filter_b_condition_json }}
28 Conclusion event
29 Source event label inheritance
30 Action ： {{ rule.action_label_inheritance_flag }}
31 Event ： {{ rule.event_label_inheritance_flag }}
32 Conclusion label settings： {{ rule.conclusion_label_settings }}
33 TTL ： {{ rule.ttl }}
34 Remarks ： {{ rule.note }}
35
36Action information
37 Action ID ： {{ action.action_id }}
38 Action name ： {{ action.action_name }}
39 Operation ID ： {{ action.operation_id }}
40 Operation name ： {{ action.operation_name }}
41 Executing Conductor ID ： {{ action.conductor_class_id }}
42 Executing Conductor name ： {{ action.conductor_name }}
43 Host
44 Event link ： {{ action.event_collaboration }}
45 Specify ： {{ action.host_id }}
46 Using parameter sheet ： {{ action.parameter_sheet_id }}
47 Remarks ： {{ action.note }}
1[TITLE]
2Post-notification
3
4[BODY]
5Event
6{%- for event in events -%}
7{%- set i = loop.index %}
8 Event #{{ i }}
9 Event ID ： {{ event.labels._id }}
10 Event collect settings ID ： {{ event.labels._exastro_event_collection_settings_id }}
11 Event collect settings name ： {{ event.labels._exastro_event_collection_settings_name }}
12 Event fetch time ： {{ event.labels._exastro_fetched_time }}
13 Event label
14{%- for key, value in event.labels.items() %}
15 ・{{ key }}：{{ value }}
16{%- endfor %}
17 Event source data
18{%- for key, value in event._exastro_events.items() %}
19 ・{{ key }}：{{ value }}
20{%- endfor -%}
21{%- endfor %}
22
23Matched results
24 Status ： {{ action_log.status }}
25 Register date/time ： {{ action_log.time_register }}
26 Executed Conductor ID ： {{ action_log.conductor_instance_id }}
27 Executed Conductor Name ： {{ action_log.conductor_instance_name }}
28 Conclusion Event label ： {{ action_log.conclusion_event_labels }}
29
30Rule information
31 Matched rule ID ： {{ rule.rule_id }}
32 Matched rule name ： {{ rule.rule_name }}
33 Condition
34 Filter A
35 Filter ID ： {{ rule.filter_a }}
36 Filter name ： {{ rule.filter_a_name }}
37 Filter condition ： {{ rule.filter_a_condition_json }}
38 Filter operator ： {{ rule.filter_operator }}
39 Filter B
40 Filter ID ： {{ rule.filter_b }}
41 Filter name ： {{ rule.filter_b_name }}
42 Filter condition ： {{ rule.filter_b_condition_json }}
43 Conclusion Event
44 Source event label inheritence
45 Action ： {{ rule.action_label_inheritance_flag }}
46 Event ： {{ rule.event_label_inheritance_flag }}
47 Conclusion label settings： {{ rule.conclusion_label_settings }}
48 TTL ： {{ rule.ttl }}
49 Remarks ： {{ rule.note }}
50
51Action information
52 Action ID ： {{ action.action_id }}
53 Action name ： {{ action.action_name }}
54 Operation ID ： {{ action.operation_id }}
55 Operation name ： {{ action.operation_name }}
56 Executing Conductor ID ： {{ action.conductor_class_id }}
57 Executing Conductor name ： {{ action.conductor_name }}
58 Host
59 Event link ： {{ action.event_collaboration }}
60 Specify ： {{ action.host_id }}
61 Using parameter sheet ： {{ action.parameter_sheet_id }}
62 Remarks ： {{ action.note }}
63
64Conductor information
65 Status ： {{ conductor.status }}
66 Operation ID ： {{ conductor.operation_id }}
67 Operation name ： {{ conductor.operation_name }}
68 Register date/time ： {{ conductor.time_register }}
69 Reservation date/time ： {{ conductor.time_book }}
70 Start date/time ： {{ conductor.time_start }}
71 End date/time ： {{ conductor.time_end }}
72 Emergency stop flag ： {{ conductor.abort_execute_flag }}
73 Remarks ： {{ conductor.note }}
Result pattern when using variables¶
- action_log.statusRule matchedExecutingCompletedCompleted (abnormal)Waiting for completion confirmationCompletion confirmedCompletion confirmation rejected
- rule.action_label_inheritance_flagUsed as a parameterNot use as a parameter
- rule.event_label_inheritance_flagInheriting Conclusion EventsNot Inheriting Conclusion Events
- conductor.statusUnexecutedUnexecuted (scheduled)ExecutingExecuting (delayed)PausedCompletedAbendEnded with warningEmergency stopCancelled reservationUnexpected error
- conductor.noteIssuednot issued