About Event Analytics
Within Event Analytics, you can determine seasonality of events (using the seasonality algorithm), and determine which events tend to occur together (using the related event group, or event pattern algorithms).
Event Analytics uses statistical analysis of IBM® Tivoli® Netcool®/OMNIbus historical event data to determine the seasonality of events, such as when and how frequently events occur. The results of this analysis are output in both reports and graphs.
- Use the View Seasonal Events UI to analyze seasonal events and associated related events.
- Deploy validated seasonal event rules, without writing new code. Rules that are generated in this way can have various actions applied to them.
Related event groups
- Use the related events UI to analyze these event groups.
- Deploy validated event groups as Netcool/Impact correlation rules with a single click, without the need to write any code. Correlation rules that are generated in this way act on real-time event data to show a single synthetic event for the events in the event group.
- Present all events in the group as children of this synthetic event. This view decreases the number of events displayed to your operations staff in the Event Viewer.
- Use the Related Event portlet to analyze patterns in groups and deploy correlation rules based on common event types between the groups.
The system uses the most actionable event in the group as the parent event to be set by the correlation rule. By default, the most actionable event in the group is the most ticketed or acknowledged event. Before you deploy the correlation rule, you can change the parent event setting. A synthetic event is created with some of the properties of the parent event, and all the related events are grouped under this synthetic event.
Event groups are generated by scheduled runs of related event configurations. A default related event configuration is provided. You can create your own configurations and specify which historical data to analyze. For example, you can specify a custom time range, an event filter, and schedule.
For more information about related events, see Related events.
In contrast to ungrouped deployed based on related event groups, the use of
patterns allows events with different
Identifier fields to be grouped in the Event
Viewer. In this case, incoming events are matched by using the Event Type field. Matching events for
deployed patterns are grouped by Resource in the Event Viewer. To allow a group of related events,
with different Resource field values, to be allocated to a pattern, use name similarity or
specify a regular expression in the pattern. To allow deployed patterns to group events across
multiple resources, use name similarity or specify a regular expression in the pattern.
You can create a pattern based on the related event groups discovered by the related event analytic. The system can also suggest name patterns to you based on the related event groups discovered by the related event analytic. You can use an event in the group as the parent event to be set by the correlation rule, or create a synthetic event as the parent. You can also test the performance of a pattern before it is created to check the number of related events groups and events returned for a pattern.
For more information about event patterns, see About event patterns.