Configuring pre-classification

In addition to automated deduplication and generic-clear event correlation, this probe also supports alarm pre-classification. Pre-classification allows you to identify and flag within the probe rules file the causal relevance of each event type. This feature enables you to overcome many of the shortcomings of Root Cause Analysis (RCA) systems by more efficiently and accurately determining the root cause of a failure from the events processed.

Advanced correlation is implemented by building a lookup table referenced by the probe rules file to determine the causal relevance of a received event before it is forwarded to the Netcool/OMNIbus ObjectServer.

Details about the causal relevance of each event type are stored in the nokia_nfmp-preclass.snmptrap.lookup file. You can modify this file to add to or change the causal relevance details.

The entry for each event type uses the following format:

{ "Event_Id","Causal_relevance" }

For example: {"Nokia-NSP-NFM-P-LinkDown","0"},

The causal relevance of each event type is defined using one of the of following predefined integer values:

0 – Unknown

1 – Root Cause

2 – Symptom

3 – Singularity

4 – Information

To determine the causal relevance assigned to an entry, use the following guidelines:

Unknown: If the condition represented by an event cannot be classified as a root cause, symptom, singularity, or informational event, it is Unknown.
Root Cause: A condition that is known not to be caused by any other detectable condition.
Symptom: A condition that is known to always be caused by another detectable condition. Generally these are events that indicate degraded conditions or failures of higher level entities or processes.
Singularity: If an event represents a degraded condition or failure that is known to not be a root cause, and cannot be caused by another condition, it is a singularity event.
Information: If an event provides information about a system that does not represent a degraded condition or failure, or it indicates the clearing, or resolution, of a previously occurring fault related condition, it is an informational event.

To use the alarm pre-classification feature provided with this probe, you must perform the tasks described in the following topics: