Topic
5 replies Latest Post - ‏2014-11-20T09:56:39Z by Harish Sharma
SystemAdmin
SystemAdmin
255 Posts
ACCEPTED ANSWER

Pinned topic Event Isolation and Correlation

‏2013-01-08T05:01:37Z |
I need some information on how to achieve the event isolation and correlation using impact , at the same time need to know how predefined policies are working .How to analyze EIC using api. How to populate the topology data ti EIC data base.Please share some knowledge ,which helps me for moving forward in this module .

Thanks in advance.
Updated on 2013-01-18T03:14:10Z at 2013-01-18T03:14:10Z by SystemAdmin
  • SystemAdmin
    SystemAdmin
    255 Posts
    ACCEPTED ANSWER

    Re: Event Isolation and Correlation

    ‏2013-01-08T19:29:04Z  in response to SystemAdmin
    The relationship data can be populated through one of the following methods :

    1. Directly from TADDM through XML toolkit
    https://www.ibm.com/developerworks/mydeveloperworks/wikis/home?lang=en#/wiki/Tivoli%20Business%20Service%20Manager1/page/Integration%20Scenarios

    2. If you have ITM in your environment, most of the agents create DLA books you can use these books to populate the SCR. ( Relationship store )

    3. Using Impact Policy API to directly populate the data.
    http://pic.dhe.ibm.com/infocenter/tivihelp/v3r1/index.jsp?topic=%2Fcom.ibm.tivoli.itbsm.doc_6.1%2Fcustomization%2Fbsmc_scrapi_overview.html
    How to use EIC :

    Information on EIC :

    http://publib.boulder.ibm.com/infocenter/tivihelp/v8r1/index.jsp?topic=%2Fcom.ibm.netcoolimpact.doc6.1%2Fcommon%2Fdita%2Feic_ui.html

    After populating the SCR,

    You need to create a rule.

    The Primary event is the event that you are trying to analyze.

    The Secondary events is a further filter in to the events that are retrieved based on the relationship information stored in SCR, if the "Limit Analysis based on relationship" is enabled. The primary and the secondary events are based on the Object server SQL. Variable substitution is available for the secondary filter.

    For example the secondary event can be : Node like '@NODE@' Where you want to replace the "NODE" with the information from the primary event. Once you create the filter , use "Extract Parameters" , to get the substitutable parameters in to the table where regular expression can be provided.

    You need to provide a regular expression to extract the variable substitution data. For example in the primary event lets say the Summary contains : System System1 experiencing high CPU, if you want to extract the value System1 and substitute in the secondary filter, the regular expression will be something like -- System (.) exp. -- the value from (.*) will be used to substitute the secondary filter.

    Save the rule.

    If the "Limit analysis based on relationship" is not enabled then , the secondary filter will be applied directly to all the events in OS with in the time period specified in the rule.

    Now to test it, you can enable your Web GUI to launch in to the analysis page. When you select the event from the WebGui and launch in to the analysis page, if the event matches the primary event filter. The rule will be applied.

    I hope this helps.

    Thanks and Regards
    Sudhakar
    • SystemAdmin
      SystemAdmin
      255 Posts
      ACCEPTED ANSWER

      Re: Event Isolation and Correlation

      ‏2013-01-09T05:23:27Z  in response to SystemAdmin
      Thanks Sudhakar .
    • SystemAdmin
      SystemAdmin
      255 Posts
      ACCEPTED ANSWER

      Re: Event Isolation and Correlation

      ‏2013-01-11T06:32:07Z  in response to SystemAdmin
      HI Sudhakar,

      I am arranged the set up for EIC , I added object server to the EIC_alertsDB , i added TBSM DB (*Which comes with the installation of DB schema comes with the Impact 6.1 launchpad and then i installed Discovery library kit too*) for SCR_DB,and Event_rulesDb , but i didnt populate any data in to that database as of now .... now if i opened the EIC_Analyze it pops up one error like below

      Error:The SoapORBClient operation failed

      Shall i continue by populating data or is there any fix for above or am i done any mistake in configuration p-lease let me know.

      Thanks in advance.

      Regs
      Vamsi.T
      • SystemAdmin
        SystemAdmin
        255 Posts
        ACCEPTED ANSWER

        Re: Event Isolation and Correlation

        ‏2013-01-18T03:14:10Z  in response to SystemAdmin
        Hi,
        What is your Impact Cluster Name ? Is it default Name : NCICLUSTER ?

        thanks and regards
        Sudhakar
        • Harish Sharma
          Harish Sharma
          7 Posts
          ACCEPTED ANSWER

          Re: Event Isolation and Correlation

          ‏2014-11-20T09:56:39Z  in response to SystemAdmin

          Hi Sudhakar,

          While i am trying to open the operator view EIC_ANALYZE i am getting following error :  Selected event is cannot be reterieved from ObjectServer.

          How can i resolve this error??

           

          Thanks

          Harish