From 5d77767a25fc4cca44a78962c69b690c61eba0e4 Mon Sep 17 00:00:00 2001
From: Patrick Toal <ptoal@takeflight.ca>
Date: Tue, 13 Oct 2026 17:49:36 -0400
Subject: [PATCH] Fixes to CPUHog EDA Listener

---
 playbooks/investigate_high_cpu.yml   | 48 ++++++++++++++--------------
 playbooks/templates/cpuhog_ticket.j2 | 10 +++---
 rulebooks/alertmanager_listener.yml  |  3 +-
 3 files changed, 31 insertions(+), 30 deletions(-)

diff --git a/playbooks/investigate_high_cpu.yml b/playbooks/investigate_high_cpu.yml
index fbc10ca..c8f7080 100644
--- a/playbooks/investigate_high_cpu.yml
+++ b/playbooks/investigate_high_cpu.yml
@@ -30,33 +30,33 @@
         instance: '{{ snow_instance }}'
         state: new
         caller: "admin"
-        short_description: "CPUHog event detected on: {{ ansible_eda.event.alert.labels.instance }}"
-        description: "A CPUHog was detected on: {{ ansible_eda.event.alert.labels.instance }} that needs to be investigated."
+        short_description: "CPUHog event detected on: {{ alertmanager_instance }}"
+        description: "A CPUHog was detected on: {{ alertmanager_instance }} that needs to be investigated."
         impact: high
         urgency: high
       delegate_to: localhost
       register: incident_result
 
-    - name: Create SNow Problem
-      servicenow.itsm.problem:
-        instance: '{{ snow_instance }}'
-        state: new
-        short_description: "{{ alertmanager_annotations.summary }}"
-        description: "Generator URL: {{ alertmanager_generator_url }}"
-        impact: high
-        urgency: high
-        attachments:
-          - path: /tmp/cpuhog_details.txt
-            name: cpuhog_details.txt
-            type: 'text/plain'
-      register: problem_result
-      delegate_to: localhost
+    # - name: Create SNow Problem
+    #   servicenow.itsm.problem:
+    #     instance: '{{ snow_instance }}'
+    #     state: new
+    #     short_description: "{{ alertmanager_annotations.summary | default('CPUHog event detected on: ' ~ alertmanager_instance) }}"
+    #     description: "Generator URL: {{ alertmanager_generator_url }}"
+    #     impact: high
+    #     urgency: high
+    #     attachments:
+    #       - path: /tmp/cpuhog_details.txt
+    #         name: cpuhog_details.txt
+    #         type: 'text/plain'
+    #   register: problem_result
+    #   delegate_to: localhost
 
-    - name: Update Incident
-      servicenow.itsm.incident:
-        instance: '{{ snow_instance }}'
-        state: in_progress
-        number: "{{ incident_result.record.number }}"
-        other:
-          problem_id: "{{ problem_result.record.number }}"
-      delegate_to: localhost
+    # - name: Update Incident
+    #   servicenow.itsm.incident:
+    #     instance: '{{ snow_instance }}'
+    #     state: in_progress
+    #     number: "{{ incident_result.record.number }}"
+    #     other:
+    #       problem_id: "{{ problem_result.record.number }}"
+    #   delegate_to: localhost
diff --git a/playbooks/templates/cpuhog_ticket.j2 b/playbooks/templates/cpuhog_ticket.j2
index 76db257..8b1954d 100644
--- a/playbooks/templates/cpuhog_ticket.j2
+++ b/playbooks/templates/cpuhog_ticket.j2
@@ -1,11 +1,11 @@
 = CPUHog Report =
 A high CPU event was triggered from AlertManager.
 
-{% if ansible_eda is defined %}
-Annotations: "{{ ansible_eda.event.alert.annotations }}"
-Generator URL: "{{ ansible_eda.event.alert.generatorURL }}"
-Severity: "{{ ansible_eda.event.alert.labels.severity }}"
-Instance: "{{ ansible_eda.event.alert.labels.instance }}"
+{% if alertmanager_instance is defined %}
+Annotations: "{{ alertmanager_annotations | default({}) }}"
+Generator URL: "{{ alertmanager_generator_url | default('') }}"
+Severity: "{{ event_severity | default('unknown') }}"
+Instance: "{{ alertmanager_instance }}"
 {% endif %}
 
 ** Top CPU Consumers **
diff --git a/rulebooks/alertmanager_listener.yml b/rulebooks/alertmanager_listener.yml
index 08db240..c068bad 100644
--- a/rulebooks/alertmanager_listener.yml
+++ b/rulebooks/alertmanager_listener.yml
@@ -39,10 +39,11 @@
             name: Demo - Investigate High CPU
             organization: OYS
             job_args:
+              limit: "{{ event.labels.hostname }}"
               extra_vars:
                 alertmanager_annotations: "{{ event.annotations }}"
                 alertmanager_generator_url: "{{ event.generatorURL }}"
-                event_severity: "{{ event.labels.severity }}"
+                event_severity: "{{ event.labels.severity | default('unknown') }}"
                 alertmanager_instance: "{{ event.labels.instance }}"
 
     - name: Test Contact Point