OID fields reference for events aggregation and correlation
Review the information for these fields so you can use them to aggregate and correlate events.
Alert and resolution events
You can aggregate and clear events by using theipasTrapIdentifier and ipasTrapExpireTime fields.
To do this, map these fields to the @Identifier and @ExpireTime ObjectServer
fields in NetCool or OMNIbus.You can correlate alert and resolution
events by using the ipasTrapAlertGroup and ipasTrapAlertKey fields.
To do this, map these fields to the @AlertGroup and @AlertKey
ObjectServer fields in NetCool or OMNIbus.
You can also use these four fields in other event management solutions for similar purposes. To view an example of these fields usage, check the sample NcKL rules that are provided with Cloud Pak System.
- ipasTrapAlertGroup
- This field is used to group events together that have affinity
to one another, such as problem and resolution events. It identifies
possible matching events that are based on type but not exact matches
based on instance-specific information. It is typically used with
the
ipasTrapAlertKeyfield to match events that might potentially resolve one another. - ipasTrapAlertKey
- This field is used to group events together that have affinity
to one another such as problem and resolution events. It identifies
instance-specific information such that it can be certain that both
events are referencing the same instance of some situation. This instance-specific
information is typically with type information in the
ipasTrapAlertGroupfield to match events that might potentially resolve one another. - ipasTrapIdentifier
- This field is used to uniquely identify an instance of a specific
alert. It can be aggregated with other instances of the same alert
to eliminate clutter in event views. It is a precise identification
of the instance of the event with information such as time and other
differences between instances of the removed event so that multiple
alerts of the same fundamental issue can be aggregated together. It
can be used with the
ipasTrapExpireTimefield to age out multiple instances that generate continuous events. - ipasTrapExpireTime
- This field is used to provide a possible expiration time in seconds
for the event as indicated by Cloud Pak System.
It is provided for informational purposes only and can be used with
the
ipasTrapIdentifierfield to determine when to resolve rising continuous events if another instance of the event is not generated. - ipasTrapSystemState
- This field is used to communicate the state of the system or the specific component when the trap was issued. This field is useful to interpret the impact of the trap. For example, a trap on a component that is under maintenance might not be a valid issue but rather because the system is in maintenance mode.