Pinned topic Event Isolation and Correlation
Thanks in advance.
Re: Event Isolation and Correlation2013-01-08T19:29:04Z in response to SystemAdminThe relationship data can be populated through one of the following methods :
1. Directly from TADDM through XML toolkit
2. If you have ITM in your environment, most of the agents create DLA books you can use these books to populate the SCR. ( Relationship store )
3. Using Impact Policy API to directly populate the data.
How to use EIC :
Information on EIC :
After populating the SCR,
You need to create a rule.
The Primary event is the event that you are trying to analyze.
The Secondary events is a further filter in to the events that are retrieved based on the relationship information stored in SCR, if the "Limit Analysis based on relationship" is enabled. The primary and the secondary events are based on the Object server SQL. Variable substitution is available for the secondary filter.
For example the secondary event can be : Node like '@NODE@' Where you want to replace the "NODE" with the information from the primary event. Once you create the filter , use "Extract Parameters" , to get the substitutable parameters in to the table where regular expression can be provided.
You need to provide a regular expression to extract the variable substitution data. For example in the primary event lets say the Summary contains : System System1 experiencing high CPU, if you want to extract the value System1 and substitute in the secondary filter, the regular expression will be something like -- System (.) exp. -- the value from (.*) will be used to substitute the secondary filter.
Save the rule.
If the "Limit analysis based on relationship" is not enabled then , the secondary filter will be applied directly to all the events in OS with in the time period specified in the rule.
Now to test it, you can enable your Web GUI to launch in to the analysis page. When you select the event from the WebGui and launch in to the analysis page, if the event matches the primary event filter. The rule will be applied.
I hope this helps.
Thanks and Regards
Re: Event Isolation and Correlation2013-01-11T06:32:07Z in response to SystemAdminHI Sudhakar,
I am arranged the set up for EIC , I added object server to the EIC_alertsDB , i added TBSM DB (*Which comes with the installation of DB schema comes with the Impact 6.1 launchpad and then i installed Discovery library kit too*) for SCR_DB,and Event_rulesDb , but i didnt populate any data in to that database as of now .... now if i opened the EIC_Analyze it pops up one error like below
Error:The SoapORBClient operation failed
Shall i continue by populating data or is there any fix for above or am i done any mistake in configuration p-lease let me know.
Thanks in advance.
Harish Sharma 270007BTS67 PostsACCEPTED ANSWER
Re: Event Isolation and Correlation2014-11-20T09:56:39Z in response to SystemAdmin
While i am trying to open the operator view EIC_ANALYZE i am getting following error : Selected event is cannot be reterieved from ObjectServer.
How can i resolve this error??