Resolved from fix pack 3

Results and weighting

Scope-based event grouping provides a containment structure for viewing all related events under a single top-level synthetic container event. In addition, it provides useful insight into the probable causes and impacts of an incident through relative weighting.

Often incidents generate many events and in such cases weighting becomes important. To respond correctly to an incident it is best to understand what the events are saying about the likely causes and impacts of the incident. Often the severity of an event is determined by the impact on the service, but critical events might not provide information about the causes of an incident.

Scope-based event grouping provides a framework for identifying probable sources and immediate consequences of an incident. The framework involves a process of weighting to work out which events contribute more to the causes and impacts of an incident.

Resolved from fix pack 4The standard cause and impact weighting values are provided in the probe rules and Netcool®/Impact policy templates, see $OMNIHOME/extensions/eventgrouping/templates. To use the weighting, assign the event type to a category using the NormalisedAlarmCode field and indicate where the event sits in the OSI stack using the OSILevel field.

As a result, based on the weighting determined by CauseWeight and ImpactWeight values, the summary field for the top containing event is constructed in the format of "impact of incident caused by probable cause".

In addition, the standard cause and impact weighting values provided mean you can sort the CauseWeight in descending order in the Event Viewer to show all the likely causes of the incident at the top. Seeing all the likely causes with weighting helps in identifying the most likely causes and prioritizing the right action to take in rectifying the fault and restoring service. The same can be done for ImpactWeight to understand the most important consequences of an incident.

To understand the standard cause and impact weighting provided in the templates, and their relation to the OSI stack, see Quick reference to fields.

Note: You can customize the ImpactWeight and Causeweight fields for the events by setting values in the Probe rules or through event enrichment. Use the templates provided for guidance.