Generic event correlation
Generic event correlation allows you to create event containers that correspond to incidents in networks and systems so you can determine the priority of the problems to be worked. The feature creates a one-to-one relationship between incidents and event containers so that first line operators can create trouble tickets from the head container events without duplication.
Generic event correlation consists of the following stages:
- Pre-classification: This consists of assigning to each alarm a generic alarm type and defining its scope. It is achieved by adding the rules files supplied with the Probe Extension Package to the probe's rules file.
- Containerization: This consists of assigning alarms to containers headed by a synthetic alarm. The containers retain the alarm's diagnostic information and enable easy access to the events grouped within the container. It is achieved by Netcool/OMNIbus automations.
- Probable cause and impact analysis: This consists of setting the probable cause and impact of each alarm. For each alarm, the probable cause is determined by considering the highest weighted cause and impact from all the alarm's children events. It is achieved by Netcool/OMNIbus automations.
- Presentation: This consists of displaying the event correlation information for a given alarm using the Web GUI Event Tables relationships feature.
Generic event correlation is currently available for the following systems:
- Alcatel-Lucent 5620 SAM v13
- Nokia-Siemens NMS2000
- Nokia-Siemens NetAct
- Correlation trigger.
This is supplied by the following SQL files
released with Netcool/OMNIbus V8.1 FP2:
The SQL files create the tables, additional columns in the alerts.status table, and automation triggers required to perform this functionality.
- Generic Event Correlation rules files. These form a part of the Probe Extension Package.
- Web GUI V8.1 for the creation of a Web GUI relationship whereby the Parent column is linked to the Identifier Key column.
Configuring the generic event correlation feature
To configure a probe to use the generic event correlation feature, follow these steps:
- Ensure you have followed the instructions in Extracting the Probe Extension Package and configuring a probe to use the additional rules.
- Install the ootb_event_grouping trigger if
it is not already installed on your Netcool/OMNIbus deployment. Note: The SQL file is provided with Netcool/OMNIbus V8.1 FP2.
the probe's rules file to include at the end
of it the new generic correlation rules file written for that probe.
See the table in Extended rules for generic event correlation for
a list of the generic correlation rules files that are available.Note: You can use Probe Rules Syntax Checker (nco_p_syntax) to verify the rules file syntax.
- In Web GUI, create
a new relationship for generic event correlation
using the following steps:
- On the Relationships tab, click the New relationship icon.
- Specify GenericParentChild as the Display Name for the new relationship.
OMNIBUSin the Data Source field.
ParentIdentifierin the Column field.
Identifierin the Key Column field.
- Click Create Relationship.
- Copy the default view
setting to create a new one so that you
do not alter the default setting of the system using the following
- Select Views from the Administration tab.
- Select Global Views.
- Select Default.
- Click the Copy View icon.
- Select the users who should have access to this view (for example, Admin user).
- Click OK.
- Assign this relationship to your new view using the following
- Select the Relationships tab.
GenericParentChildin the Relationship field.
- Click Save and Close
- Restart the probe or use the probe reload rules file utility if it has been enabled.
- The correlation between each site parent and
child grouped together
SiteNameParentsynthetic events are further grouped under the
Severityof each parent event is set to the highest severity of any of its child events.
ScopeIdParentevent (parent of all site parent events)
Summarydisplays the number of sites affected.