Hello everyone
I've finally managed to get this working. I created a new Expression called Error which uses the following code:
def checks = checkObservationAlarms(#LogFilter_ErrorVerbose for 1 ms#,
{entry ->
if (entry.get("Severity") == "WARNING") {
return 2;
}
if (entry.get("Severity") == "CRITICAL") {
return 3;
}
if (entry.get("Severity") == "FATAL") {
return 4;
}
return 0;
},
{entry, severity -> switch(severity) {
case 2:
return "Warning";
case 3:
return "Critical";
case 4:
return "Fatal";
default:
return "";
} },@foglight_rule_id);
if (checks.size() > 0) {
return checks[0][1];
} else {
return "";
}
...which I picked up from the Community forums. I also created an additional Expression call UserError which takes the custom error that you supply in the Message Trap List within the agent which uses the following code:
def checks = checkObservationAlarms(#LogFilter_ErrorVerbose for 1 ms#,
{entry ->
if (entry.get("Severity") == "WARNING") {
return 2;
}
if (entry.get("Severity") == "CRITICAL") {
return 3;
}
if (entry.get("Severity") == "FATAL") {
return 4;
}
return 0;
},
{entry, severity -> switch(severity) {
case 2:
return entry.get("User_Message");
case 3:
return "" + entry.get("User_Message") + "";
case 4:
return "" + entry.get("User_Message") + "";
default:
return "";
} },@foglight_rule_id);
if (checks.size() > 0) {
return checks[0][1];
} else {
return "";
}
The more observant amongst you will notice that case 2 has a different format to case 3 and case 4 in the above.
Part of the reason for this rule taking so long to program is that if I made a change to the code in the rule (e.g. changing WARNING to Warning in the case statement of the first code), Foglight would not register the change and would instead create either a null or a blank value. The following bizarre workaround often worked: I would change it back to what it originally was, trigger the alarm, change it to what it should be, trigger the alarm and keep doing that until the change was eventually recognised. For the above code, no matter how often I changed case 3 and case 4 to resemble the format of case 2, I could never get it to work 
This behaviour only affected this particular rule; other custom rules that I have programmed in the past have been absolutely fine.
My Subject2 line therefore becomes:
@ServerName : @Error: @UserError
(@ServerName is defined elsewhere) which gives a very nice:
some.server.com : Warning: NetWorker Backup Failure - Backup Failed
...which is exactly what I'm looking for.
Brian
