Defining event relationships

Use event relationships to organize an Event Viewer. Event relationships group events in the list by the relationships between them.

For example, some events can be considered to be the root causes of problems and some events can be considered to be symptoms of those problems. You can define a hierarchical event relationship in which root cause events are treated as parent events, and are displayed at the top level of the hierarchy, and symptom events are treated as child events and are displayed below root cause events in the hierarchy.

Use the Relationship Definitions widget to define and manage event relationships. You can create, edit, and delete relationships.

This relationship function does not persist after a manual sort of events, for example when you click or sort by a column header in the Event Viewer.

About this task

The relationship definition contains two fields, Column and Key column, that define the parent-child relationship. You assign fields from the alerts.status table to the Column field and Key column field. The Key column field defines which field of the alerts.status table uniquely identifies parent events. In child events, the Column field is set to the value of the Key column field of the parent event, to indicate which event is the parent of the child events.

The alerts.status field that you set in the Column field is most effective if the field contains unique, numeric values only. It is possible to set a text field, but the performance of the Event Viewer might be impaired. If you set a field that does not contain unique values, duplicate tree structures are displayed in the Event Viewer, to account for the non-uniqueness of the field values.

The Web GUI is supplied with a predefined event relationship. This relationship organizes an Event Viewer by root causes and symptoms for events that are generated by IBM® Tivoli® Network Manager. Additional configuration is shipped with the Tivoli Netcool®/OMNIbus server components that creates a relationship between root-cause and symptom events that originate from a virtual environment. If the Tivoli Netcool/OMNIbus deployment is set up to monitor virtual events, you can apply this relationship to the Web GUI by running the WAAPI client on a WAAPI command file.

Procedure

To create or edit an event relationship:

  1. In the Relationship Definitions page, click Create New Relationship or select an existing relationship and click Modify Selected Relationship.
  2. Complete the following fields:
    Name
    Provide an identifier for this relationship that is unique among all the defined relationships. The identifier cannot include spaces.
    Display name
    Provide a name that users see when selecting a relationship to apply to the Event Viewer.
    Description
    Provide a description of the relationship.
    Data sources
    Select the data sources that this relationship uses:
    1. Click the arrow next to Data sources to reveal a list of the available data sources.
    2. Set the check box for each data source to include in this relationship.
    Column
    Select the column that defines the relationship.
    Key Column
    Select the column that is the key for the column selected in Column.
    Functionality delivered in fix pack 14Enable Multiple datasource Aggregations
    If you want events in the Event Viewer to be aggregated across all the data sources, by the Column value and the Key Column value, select this check-box.
  3. Save and close the Relationship Definitions page.
  4. Use the View Builder to add the relationship to an existing view, or create a new view and add the relationship to that view.
  5. Apply the view in which you defined the relationship to the Event Viewer and test that the tree-structure is displayed and contains the expected parent-child event relationship.
  6. If you do not want the fields defined in the column and key column of the event relationship to be visible in the Event Viewer, re-edit the view and hide these fields.

Example

The shipped configuration for Network Manager IP Edition uses the following fields of the alerts.status table to define a parent-child relationship between symptom and root-cause events.
NmosSerial
This field is set as the column. If an event is a symptom event, the Serial value of the root-cause event is assigned to the NmosSerial field. If the event is a root-cause event, the NmoSerial field is empty.
Serial
This field is set as the key column, so is the parent of the parent child-relationship.

To show how this configuration works, consider the following example: An event with a Serial value of 35 is identified as a root-cause event. Events with the Serial values 23, 45, and 102, are identified as symptoms of the root-cause. In the Event Viewer, Serial 35 is the root of the tree structure and 23, 45, 102 are the subnodes. The NmosSerial value of events 23, 45, and 102 is 35, to indicate that they are symptoms of the root-cause.

What to do next

If your deployment includes IBM Tivoli Netcool/Impact, you can perform further event enrichment on the events in the relationship.