Removal

Patterns that are triggered on directly discovered data can specify specific rules for removing nodes and relationships previously created by the same pattern. If there are no removal specifications, removal for nodes created by such patterns is based on ageing. Removal for nodes created by patterns triggered from other data (such as other inferred nodes) is based on existence of the originally triggering nodes.

Removal blocks take the form:

removal
  on name := node_kind removal_condition \[ where condition ];
  // removal body...
end removal;

An example is:

removal
  on si := SoftwareInstance aged;
  // This SoftwareInstance has a flag to indicate it should
  // not be removed.
  if not si.keep_me then
    model.destroy(si);
  end if;
end removal;

Two removal conditions are currently supported, aged and unconfirmed. If aged is specified, the removal block is executed at the time the node in question would normally be removed due to ageing - i.e. that it has not been confirmed for a while according to the ageing parameters.

If unconfirmed is specified, the removal block executes every time a scan of the relevant host is performed without the node in question being confirmed.

The optional where clause can be used to only trigger execution of the removal block when the inferred node matches the criteria. The conditions take the same form as those within the trigger block (see trigger conditions).

If a pattern creates multiple nodes, the removal block is executed for each of them when the removal condition is met. More than one removal block can be specified to support patterns that create more than one kind of node, and to support different blocks where the node kind is the same, but the conditions are different.

Once a pattern has at least one removal block, the normal automatic ageing of all the inferred nodes the pattern creates is disabled. Explicit removal rules must be provided for all the created nodes.

BMC Software

Removal