3.2 Understanding Trigger Expressions

An expression is a simple rule that cannot contain other rules. When you configure an expression, you specify the criteria the trigger uses to match an incoming event, such as:

The type of event the trigger must match, either a base event or a named event. For more information about event types, see Understanding Events.
The event attribute the trigger must evaluate on the incoming events.
How the value of the event attribute compares to a specified value, such as is equal to or is less than.
The value to which the trigger compares the attribute value on the incoming event.

3.2.1 Understanding Initiation Expressions

The Initiate New Work Item If tab provides the following expressions:

Any event of a specific type and attribute value

This expression matches a single base event with a specific value for one of the attributes. The time window does not apply. For example, to initiate a work item when Workflow Automation receives any AppManager event for which the KS name is NT_ServiceDown, configure the expression as follows:

Any event of a specific type which fails to match other triggers within the time window

This expression matches a specific event that does not match any other triggers during the specified time window.

NOTE:This trigger expression is not related to workflow priority. For more information about workflow priority, see Understanding Workflow Priority.

If you use a base event, the trigger does not evaluate any attribute values on the incoming event. For example, if you specify AppManager.Event, the trigger initiates a work item when it matches any AppManager event that does match another trigger within the specified time window.

If you use a named event, the trigger ensures the event matches the specified attribute values on the named event. For example, if you create a named event called NT_ServiceDown, where the event type is AppManager.Event and the value for the AppManager KS Name attribute is NT_ServiceDown, the trigger initiates a work item only if an event with the specified values does not match any other trigger within the specified time window.

To ensure the event does not match other triggers during the specified time window, Workflow Automation requires approximately one minute of additional processing time. For example, if the time window is 2 minutes, Workflow Automation initiates a work item approximately three minutes after the event arrives.

Any event which fails to match other triggers within the time window

This expression matches any non-specified event that does not match any other triggers during the specified time window. The trigger ignores the event type and all attribute values. For example, you can use this expression to ensure Workflow Automation responds to all events.

NOTE:This trigger expression is not related to workflow priority. For more information about workflow priority, see Understanding Workflow Priority.

Any N or more events from the same business service

This expression matches a minimum number of non-specified events from the same business service within the specified time window. N must be greater than 1. The trigger ignores the event type and all attribute values. For example, to initiate a work item from three or more events that arrive from the same business service within two minutes, regardless of the event type or the relationship of the events, configure the template as follows:

Any N or more events from the same cluster

This expression matches a minimum number of non-specified events from the same cluster within the specified time window. N must be greater than 1. The trigger ignores the event type and all attribute values. For example, to initiate a work item from two or more events that arrive from the same cluster within two minutes, regardless of the event type or the relationship of the events, configure the template as follows:

Any N or more events from the same computer

This expression matches a minimum number of non-specified events from the same computer within the specified time window. N must be greater than 1. The trigger ignores the event type and all attribute values. For example, to initiate a work item from two or more events from the same server within two minutes, regardless of the event type or the relationship of the events, configure the template as follows:

Any N or more events of a specific type

This expression matches a minimum number of events of the same type within the specified time window. N must be greater than or equal to 1.

NOTE:If you set N to 1, the trigger ignores the specified time window and the expression behaves the same as One event of a specific type.

If you use a base event, the trigger does not evaluate any attribute values on the incoming event. For example, if you set N to 2 and specify AppManager.Event, the trigger initiates a work item when it matches at least two AppManager events within the specified time window.

If you use a named event, the trigger ensures the event matches the specified attribute values on the named event. For example, if you set N to 2 and create a named event called NT_ServiceDown, where the event type is AppManager.Event and the value for the AppManager KS Name attribute is NT_ServiceDown, the trigger initiates a work item when at least two events with the specified values arrive within the specified time window.

Any N or more events of a specific type with identically valued attributes

This expression matches a minimum number of events within the specified time window, if the values of the specified attributes are identical on all events. N must be greater than 1.

If you use a base event, the trigger compares only the specified attributes. For example, to initiate a work item if two or more Exchange.New Message Event events occurring within two minutes of each other have the same subject, configure the expression as follows:

If you use a named event, the trigger evaluates the attributes associated with the named event as well as the attributes you specify for the expression. For example, if you create a named event called Exchange Server Down, where the event type is Exchange.New Message Event and the value for the Subject attribute is Exchange Server Down, you can specify additional attributes in the trigger expression, such as Sender Email Address and Status. If you set N to 2, the trigger initiates a work item only if two or more events with identical values for all specified attributes arrive within the specified time window.

Combination of events with different attributes having common values

This expression matches any combination of at least two events within the specified time window, if the specified attributes have identical values.

NOTE:This expression has its own time window. By default, the expression inherits the value of the time window from the parent operator.

If you use base events, the trigger compares only the specified attributes. For example, the following configuration compares the AppManager Machine Name attribute on an AppManager event to the Virtual Machine Name attribute on a vCenter event. The trigger ignores all other attributes and values.

If you use named events, the trigger evaluates the attributes associated with the named events as well as the attributes you specify for the expression. For example, the following configuration initiates a work item only if two events matching the attributes on the named events and having identical values for the specified attributes in the expression occur within two minutes of each other.

Combination of events with same attributes having common values

This expression matches any combination of at least two events within the specified time window, if each event has an identical value for the specified attribute.

NOTE:This expression has its own time window. By default, the expression inherits the value of the time window from the parent operator.

If you use base events, the trigger compares only the specified attributes. For example, the following configuration compares the Resource Group Name attribute on an AppManager event, an Aegis event, and a vCenter event. The trigger ignores all other attributes and values.

If you use named events, the trigger evaluates the attributes associated with the named events as well as the attributes you specify for the expression. For example, the following configuration initiates a work item only if events matching the attributes on at least two of the named events and having identical values for the Resource Group Name attribute occur within two minutes of each other.

Compare multiple attribute values of two different events

This expression matches a combination of two specific events within the specified time window, if at least two specified attributes (one from each event) have identical values. To make the comparisons more restrictive, you can add more attributes to the expression.

This expression provides the following operators for the list of attributes you want to compare:

All requires the two events to have identical values for all of the attributes.
Any requires the two events to have identical values for any or all of the attributes.
None requires the two events to not have identical values for all of the attributes.
Not Any requires the events to not have identical values for any or all of the attributes.

If you use base events, the trigger compares only the specified attributes. For example, the following configuration compares the Event Message attribute on a vCenter event to the Resource Name attribute on an AppManager event. The trigger ignores all other attributes and values.

Compare two attribute values of two different events

This expression matches a combination of two specific events within the specified time window, if two specific attributes (one from each event) have identical values. If you want to compare more than two attributes, use the Compare multiple attribute values of two different events expression.

If you use base events, the trigger compares only the specified attributes. For example, the following configuration compares the Event Message attribute on a vCenter event to the Computer Name attribute on an AppManager event. The trigger ignores all other attributes and values.

One event of a specific type

This expression matches one specific event. The time window does not apply.

If you use a base event, the trigger does not evaluate any attribute values on the incoming event. For example, to initiate a work item when Workflow Automation receives any vCenter event, configure the expression as follows:

If you use a named event, the trigger ensures the event matches the specified attribute values on the named event. For example, to initiate a work item when Workflow Automation receives a named event called VM Detected Down, where the event type is VMware.vCenter Event and the value for the Status attribute is Closed, configure the expression as follows:

Scheduled event

This expression matches any scheduled event from a specific event schedule. The time window does not apply. For example, the following configuration initiates a work item when the AE: Maintenance Mode Check event schedule generates an event.

Sequence of events

This expression matches a specific sequence of events within the specified time window. The expression compares the values for the same time-related sequence attribute on each of the events to determine the order of occurrence.

NOTE:This expression has its own time window. By default, the expression inherits the value of the time window from the parent operator.

If you use base events, the trigger evaluates only the specified sequence attribute. For example, the following configuration initiates a work item if an AppManager event, a vCenter event, and an Aegis event occur in the specified order within three minutes of each other according to the Creation Time sequence attribute. The trigger ignores all other attributes and values.

If you use named events, the trigger evaluates the attributes associated with the named events as well as the specified sequence attribute. For example, the following configuration initiates a work item only if three events matching the attributes on the named events occur in the specified order within three minutes of each other according to the Creation Time sequence attribute.

Sequence of events with same attributes having common values

This expression matches a specific sequence of events within the specified time window, if each event has an identical value for the specified attribute. The expression compares the values for the same time-related sequence attribute on each of the events to determine the order of occurrence.

NOTE:This expression has its own time window. By default, the expression inherits the value of the time window from the parent operator.

If you use base events, the trigger evaluates only the specified common and sequence attributes. For example, the following configuration initiates a work item if an AppManager event, a vCenter event, and an Aegis event have the same Resource Group attribute value, and occur in the specified order within three minutes of each other according to the Creation Time sequence attribute. The trigger ignores all other attributes and values.

If you use named events, the trigger evaluates the attributes associated with the named events as well as the specified sequence attribute. For example, the following configuration initiates a work item only if three events matching the attributes on the named events have the same Resource Group attribute value, and occur in the specified order within three minutes of each other according to the Creation Time sequence attribute.

3.2.2 Understanding Blocking Expressions

Workflow Automation can prevent a large number of unnecessary work items by blocking the following types of events:

Repetitive events	A data source may repeatedly send identical events during the course of an outage but the first notice is usually sufficient.
Symptomatic events	One failure may have downstream impacts, each of which generates a symptomatic event. Fix the root cause and many of these events go away.
False warnings	Performance management systems often have static and inexact thresholds that lead to a large number of warnings when there is no real problem.

A trigger can block the creation of new work items by ignoring events that match the rules on the Block New Work Item If tab. By default, the trigger blocks matching events for the life of the work item, but you can configure the trigger to block matching events for a specific period of time after the work item starts. For example, if you expect a work item to run for an extended period of time after the trigger initiates it, you can configure the trigger to block subsequent matching events for the first 10 minutes the work item runs. After 10 minutes, the trigger stops blocking matching events.

NOTE:Process Authors can also define work item-level blocks when designing a workflow. A work item block terminates a running work item if it meets pre-defined conditions. For example, a conditional connector can take the workflow to an End of Workflow activity.

The Block New Work Item If tab provides the following expressions:

Any event from event source if this event initiated new work item

This expression matches any event from the same computer, business service, resource group, or business service role as the event that previously initiated the work item. The trigger does not evaluate any other attributes on the event. For example, if the trigger previously initiated a work item when Workflow Automation received an event in the Exchange Servers resource group, you can block additional matching events from initiating new work items during the first 10 minutes of the life of the existing work item by configuring the expression as follows:

Any event matching attributes of the event that initiated new work item

This expression has the following sub-expressions:

Event attribute matching attribute of event(s) that initiated new work item - Compares the value of an attribute on the current event to the value of an attribute on the event that initiated the work item, similar to the ON clause of a SQL JOIN statement. To evaluate multiple attributes on the current event, add multiple instances of this sub-expression. If multiple events initiated the work item, the attribute value on the current event can match the attributes on one or more of the triggering events. This is the primary sub-expression. The other sub-expressions are qualifiers.
Attribute of event(s) that initiated new work item matching event value - Compares an attribute on the triggering event to a specific value, similar to the WHERE clause of a SQL JOIN statement. To evaluate multiple attributes on the triggering event, add multiple instances of this sub-expression. If multiple events initiated the work item, the trigger evaluates all of them. For best results, use this sub-expression as a qualifier for the Event attribute matching attribute of event(s) that initiated new work item sub-expression. Do not use it by itself.
Event attribute matching event value - Compares the value of an attribute on the current event to a specific value, similar to the WHERE clause of a SQL JOIN statement. To evaluate multiple attributes on the current event, add multiple instances of this sub-expression. For best results, use this sub-expression as a qualifier for the Event attribute matching attribute of event(s) that initiated new work item sub-expression. Do not use it by itself.

For example, if the trigger previously initiated a work item when Workflow Automation received an AppManager event, you can block a new AppManager event from initiating a new work item during the first 10 minutes of the life of the existing work item if:

The new event is from the same computer as the original event
The triggering event belongs to a specific resource group, such as Resource Group A
The new event has a specific Knowledge Script associated with it, such as NT_NetworkBusy

Configure the sub-expressions as follows:

This configuration functions like a SQL JOIN statement with the following syntax:

SELECT *

FROM NewEvent

INNER JOIN TriggeringEvent

ON NewEvent.ComputerName=TriggeringEvent.ComputerName

WHERE TriggeringEvent.ResourceGroup = ResourceGroupA AND NewEvent.KSName = NT_NetworkBusy

Where NewEvent is the new AppManager event and TriggeringEvent is the AppManager event that initiated the work item.

Any event of a specific type and attribute value

This expression matches a single event with a specific value for one of the attributes. For example, if the trigger previously initiated a work item when Workflow Automation received an AppManager event for which the KS name is NT_SystemUptime, you can block events where the KS name is NT_ServiceDown from initiating new work items during the first 10 minutes of the life of the existing work item by configuring the expression as follows:

To match multiple attributes on the new event, add multiple instances of this expression. For example, if you want to block new AppManager events where the KS name is NT_ServiceDown only if the event is from a specific computer, such as Computer01, configure the expression as follows:

Any event of a specific type from event source if this event initiated new work item

This expression matches a single event from a specific computer, business service, resource group, or business service role.

If you use a base event, the trigger does not evaluate any other attributes on the event. For example, if the trigger previously initiated a work item when Workflow Automation received an event in the Exchange Servers resource group, you can block additional matching events from the same resource group from initiating new work items by configuring the expression as follows:

If you use a named event, the trigger ensures the event matches the specified attribute values on the named event. For example, if the trigger previously initiated a work item when Workflow Automation received an Exchange Server Down event for the Exchange Servers resource group, you can block additional matching events from the same resource group from initiating new work items by configuring the expression as follows:

One event of a specific type

This expression matches one specific event. The time window does not apply.

If you use a base event, the trigger does not evaluate any attribute values on the incoming event. For example, if the trigger previously initiated a work item when Workflow Automation received a vCenter event, you can block additional matching events from initiating new work items by configuring the expression as follows:

If you use a named event, the trigger ensures the event matches the specified attribute values on the named event. For example, if the trigger previously initiated a work item when Workflow Automation received a VM Detected Down named event, you can block additional matching events from initiating new work items by configuring the expression as follows:

3.2.3 Understanding Appending Expressions

A trigger can append events that match the rules on the Append to Previous Work Item If tab to the work item. By default, the trigger appends matching events for the life of the work item, but you can configure the trigger to append matching events for a specific period of time after the work item starts. For example, if you expect a work item to run for an extended period of time after the trigger initiates it, you can configure the trigger to append subsequent matching events for the first 10 minutes the work item runs. After 10 minutes, the trigger stops appending matching events.

NOTE:A single event can trigger or be appended to multiple work items.

The Append to Previous Work Item If tab provides the following expressions:

Any event from event source if this event initiated new work item

This expression matches any event from the same computer, business service, resource group, or business service role as the event that previously initiated the work item. The trigger does not evaluate any other attributes on the event. For example, if the trigger previously initiated a work item when Workflow Automation received an event in the Exchange Servers resource group, you can append additional matching events to the existing work item during its first 10 minutes by configuring the expression as follows:

Any event matching attributes of the event that initiated new work item

This expression has the following sub-expressions:

Event attribute matching attribute of event(s) that initiated new work item - Compares the value of an attribute on the current event to the value of an attribute on the event that initiated the work item, similar to the ON clause of a SQL JOIN statement. To evaluate multiple attributes on the current event, add multiple instances of this sub-expression. If multiple events initiated the work item, the attribute value on the current event can match the attributes on one or more of the triggering events. This is the primary sub-expression. The other sub-expressions are qualifiers.
Attribute of event(s) that initiated new work item matching event value - Compares an attribute on the triggering event to a specific value, similar to the WHERE clause of a SQL JOIN statement. To evaluate multiple attributes on the triggering event, add multiple instances of this sub-expression. If multiple events initiated the work item, the trigger evaluates all of them. For best results, use this sub-expression as a qualifier for the Event attribute matching attribute of event(s) that initiated new work item sub-expression. Do not use it by itself.
Event attribute matching event value - Compares the value of an attribute on the current event to a specific value, similar to the WHERE clause of a SQL JOIN statement. To evaluate multiple attributes on the current event, add multiple instances of this sub-expression. For best results, use this sub-expression as a qualifier for the Event attribute matching attribute of event(s) that initiated new work item sub-expression. Do not use it by itself.

For example, if the trigger previously initiated a work item when Workflow Automation received an AppManager event, you can append a new AppManager to the existing work item during its first 10 minutes if:

The new event is from the same computer as the original event
The triggering event belongs to a specific resource group, such as Resource Group A
The new event has a specific Knowledge Script associated with it, such as NT_NetworkBusy

Configure the sub-expressions as follows:

This configuration functions like a SQL JOIN statement with the following syntax:

SELECT *

FROM NewEvent

INNER JOIN TriggeringEvent

ON NewEvent.ComputerName=TriggeringEvent.ComputerName

WHERE TriggeringEvent.ResourceGroup = ResourceGroupA AND NewEvent.KSName = NT_NetworkBusy

Where NewEvent is the new AppManager event and TriggeringEvent is the AppManager event that initiated the work item.

Any event of a specific type and attribute value

This expression matches a single event with a specific value for one of the attributes. For example, if the trigger previously initiated a work item when Workflow Automation received an AppManager event for which the KS name is NT_SystemUptime, you can append additional matching events where the KS name is NT_SystemUptime to the existing work item by configuring the expression as follows:

Any event of a specific type from event source if this event initiated new work item

This expression matches a single event from a specific computer, business service, resource group, or business service role.

If you use a base event, the trigger does not evaluate any other attributes on the event. For example, if the trigger previously initiated a work item when Workflow Automation received an event in the Exchange Servers resource group, you can append additional matching events from the same resource group to the existing work item by configuring the expression as follows:

If you use a named event, the trigger ensures the event matches the specified attribute values on the named event. For example, if the trigger previously initiated a work item when Workflow Automation received an Exchange Server Down event for the Exchange Servers resource group, you can append additional matching events from the same resource group to the existing work item by configuring the expression as follows:

One event of a specific type

This expression matches one specific event. The time window does not apply.

If you use a base event, the trigger does not evaluate any attribute values on the incoming event. For example, if the trigger previously initiated a work item when Workflow Automation received a vCenter event, you can append additional matching events to the existing work item by configuring the expression as follows:

If you use a named event, the trigger ensures the event matches the specified attribute values on the named event. For example, if the trigger previously initiated a work item when Workflow Automation received a VM Detected Down named event, you can append additional matching events to the existing work item by configuring the expression as follows: