Migrating Netcool correlations to Cloud Pak for AIOps

Custom correlations in Netcool

Many implementations of Netcool include custom correlations where one or more child events are linked to a parent event. While the grouping engine itself is eventually deactivated at the Netcool layer, in a combined Netcool and Cloud Pak for AIOps deployment, the correlation logic can remain in-place. With the grouping instead done at the Cloud Pak for AIOps layer. A method for achieving this is outlined here.

Procedure

1. Create a custom correlation field.

   Create a custom field to hold the key data value that will tie each event set together. Use the nco_sql utility to create the field:

   1> ALTER TABLE alerts.status ADD COLUMN CustomCorrelation1 VARCHAR(64);
   2> go     
   

2. Modify the correlation logic.

   The next step is to modify the automation that is correlating the events together, whether it's a Netcool/OMNIbus ObjectServer trigger or a Netcool/Impact policy. The logic of the automation remains the same as before, the only change being how the events are tied together. In the new correlation design, the automation must compute a key data value that is set in the newly created custom correlation field - in this case @CustomCorrelation1. The value must be set to the same value across all members of the correlation set, and be sufficiently unique so that incorrect items are not inadvertently correlated together.

3. Map the custom correlation field.

   Map the custom correlation field to Cloud Pak for AIOps. This is done in Cloud Pak for AIOps by editing the mapping of your Netcool integration instance and adding in a details attribute. The following extract from a Netcool integration mapping shows the insertion of the details section into the mapping, immediately under the expirySeconds attribute:

   "eventCount": alert.@Tally,
   "signature": alert.@Identifier,
   "firstOccurrenceTime": alert.@FirstOccurrence,
   "lastOccurrenceTime": alert.@LastOccurrence,
   "severity": alert.@Severity < 0 ? 1 : alert.@Severity = 0 ? 2 : alert.@Severity < 6 ? alert.@Severity + 1 : alert.@Severity >= 6 ? 6,
   "state": alert.@Severity = 0 ? "clear" : "open",
   "acknowledged": alert.@Acknowledged = 1 ? true : false,
   "expirySeconds": alert.@ExpireTime = 0 ? undefined : alert.@ExpireTime,
   "details": {
       "customCorrelation1": alert.@CustomCorrelation1 = "" ? undefined : alert.@CustomCorrelation1
   },     
   

   Click Save to save your new integration mapping. Note, this results in the Netcool Connector pod restarting. The new mapping will only take effect on events that are newly inserted into the Netcool/OMNIbus ObjectServer. You can add as many custom correlation fields (comma separated) as required to this details section.

4. Create a Cloud Pak for AIOps correlation policy.

   The final step is to create a scope-based grouping automation policy in Cloud Pak for AIOps to group the incoming event stream by your newly created attribute.

   1. Give your policy a meaningful name.

   2. Set the priority.

   3. For the policy trigger, select Before an alert is created.

   4. Add a condition that the policy fires when your custom attribute is "not empty".

   5. Under Create a scope-based grouping, enter your custom attribute.

   6. Specify the required time window.

   7. Specify whether the time window is rolling or fixed.

      Example scope-based policy

      

   8. Click Create Policy.

You should now start to see your custom correlation working in Cloud Pak for AIOps. Remember, this policy will only work for new events, not existing events.

One of the major advantages in Cloud Pak for AIOps over Netcool is that you can set up as many scope-based grouping automations as required. Therefore, you can use this process to migrate all of your custom correlations in Netcool over to Cloud Pak for AIOps.