Results and weighting
Scope-based event grouping provides a containment structure for viewing all related events under a single top-level synthetic container event. In addition, it provides useful insight into the probable causes and impacts of an incident through relative weighting.
Often incidents generate many events and in such cases weighting becomes important. To respond correctly to an incident it is best to understand what the events are saying about the likely causes and impacts of the incident. Often the severity of an event is determined by the impact on the service, but critical events might not provide information about the causes of an incident.
Scope-based event grouping provides a framework for identifying probable sources and immediate consequences of an incident. The framework involves a process of weighting to work out which events contribute more to the causes and impacts of an incident.
The standard cause and impact
weighting values are provided in the probe rules and Netcool®/Impact policy
templates, see $OMNIHOME/extensions/eventgrouping/templates.
To use the weighting, assign the event type to a category using the
and indicate where the event sits in the OSI stack using the
As a result, based on the weighting determined by
the summary field for the top containing event is constructed in the
format of "impact of incident caused by probable cause".
In addition, the standard cause and impact weighting values provided
mean you can sort the
CauseWeight in descending order
in the Event Viewer to show all the likely causes of the incident
at the top. Seeing all the likely causes with weighting helps in identifying
the most likely causes and prioritizing the right action to take in
rectifying the fault and restoring service. The same can be done for
understand the most important consequences of an incident.
To understand the standard cause and impact weighting provided in the templates, and their relation to the OSI stack, see Quick reference to fields.
Causeweightfields for the events by setting values in the Probe rules or through event enrichment. Use the templates provided for guidance.