Configure grouping for cloud or hybrid deployments

Learn how to configure grouping for your cloud or hybrid deployment.

You can group events based on known relationships. Based on the information stored about your infrastructure, you can automatically group events relating to an incident if they have the same scope and occur during the same time period.

Properties stored in the master.cea_properties table support certain options in the grouping triggers, which run in the ObjectServer to support IBM® Netcool® Operations Insight® on Red Hat® OpenShift®. The properties in this table are part of the schema definition that is pushed to the ObjectServer.

Configure grouping for your cloud or hybrid deployment by editing the properties in the master.cea_properties table. The properties are listed in the following tables.

The following table contains miscellaneous properties.

Table 1. Miscellaneous properties in the master.cea_properties table
Property	Description
`CEAChildParentClearType`	When this property is set to 1, the cea_canclear_parent procedure clears the parent immediately. If the property is set to 0, it clears only if no `TTNumber` value is set.
`CEAVersion`	Specifies the product version.
`CEAPropagateTTNumber`	Default value 1. Specifies whether to propagate the `TTNumber` to children events.
`CEAPropagateAcknowledged`	Default value 1. Specifies whether to propagate the acknowledged status to children events.
`CEAPropagateOwnerUID`	Default value 1. Specifies whether to propagate the `OwnerUID` to children events.
`CEAPropagateOwnerGID`	Default value 1. Specifies whether to propagate the `OwnerGID` to children events.
`CEAUseCKeyCustomText`	Default value 0. Specifies whether to append the `CustomText` to the `CEACorrelationKeyParent` summary field.
`CEAPropagateTextToCKeyParentCause`	Default value 0. Specifies whether to populate the `CustomText` of the `CEACorrelationKeyParent` event by using the `CustomText` of the underlying child event with the highest `CauseWeight` value.
`CEAPropagateTextToCKeyParentImpact`	Default value 0. Specifies whether to populate the `CustomText` of the `CEACorrelationKeyParent` event by using the `CustomText` of the underlying child event with the highest `ImpactWeight` value.
`CEAPropagateTextToCKeyParentFirst`	Default value 0. Specifies whether to populate the `CustomText` of the `CEACorrelationKeyParent` event by using the `CustomText` of the underlying child event with the lowest `FirstOccurrence` value.
`CEAPropagateTextToCKeyParentLast`	Default value 0. Specifies whether to populate the `CustomText` of the `CEACorrelationKeyParent` event by using the `CustomText` of the underlying child event with the highest `LastOccurrence` value.

The following table contains global properties that are used in scope-based grouping. These properties relate to how a grouping is done. They are applied at the time that an event is inserted, or at the time the ScopeID of an event is set.

Table 2. Global properties in the master.cea_properties table
Property group	Property	Description
	`CEAQuietPeriod`	Default value 20 * 60. Defines a global quiet period to use when not defined in the event. Note: From version 1.6.11 onwards, the `CEAQuietPeriod` parameter is not used to control timing. For more information, see Configure aggregation settings.
	`CEAParentCreationType`	Default value 1. Specifies whether synthetic parents are either created immediately (0), delayed until there are two members (1), or suppressed (2).
	`CEAUseNodeForCKeyParent`	Default value 0. If enabled, this property uses the node of the first event for the grouping to populate the node field in the synthetic `CEACorrelationKeyParent` event.
If events in the group are enriched with MIME classification data (`CEAScore`) and `CEAUseSummaryMimeChild` is enabled, the derived summary is used when there is a scoring present. Otherwise, it fails over to using the summary of either the first or last member of the group. If `CEAUseSummaryFirstChild` and `CEAUseSummaryLastChild` are both enabled, the summary of the first member is used first.	`CEAUseSummaryFirstChild`	Default value 1. Specifies that the summary of the child with the lowest first occurrence should be included in the summary of `CEACorrelationKeyParent` events.
	`CEAUseSummaryLastChild`	Default value 0. Specifies that the summary of the child with the highest first occurrence should be included in the summary of `CEACorrelationKeyParent` events.
	`CEAUseSummaryMimeChild`	Default value 1. Specifies that the summary of the child with the highest mime score should be included in the summary of `CEACorrelationKeyParent` events. This property has precedence over `CEAUseSummaryFirstChild`, but only if there is a mime score set.

The following table contains properties that control what is written to journal entries and which parent is used for adding journal entries. These properties relate to how a grouping is done and are applied at the time an event is inserted, or at the time the ScopeID of an event is set.

Table 3. Journal entry properties in the master.cea_properties table
Property	Description
`CEAJournalToSiteNameParent`	Default value 0. Specifies whether to journal child events to the `SiteNameParent` event.
`CEAJournalToCKeyParent`	Default value 0. Specifies whether to journal child events to the `CEACorrelationKeyParent` event.
`CEAJournalToSuperParent`	Default value 0. Specifies whether to journal child events to the super parent event.
`CEAJournalMaxEventsPerEntry`	Default value 20. Specifies how many events to roll up into a single journal entry.
`CEAJournalServerNameServerSerial`	Default value 1. Specifies whether to send the `ServerName`:`ServerSerial` fields to the parent event journal.
`CEAJournalNode`	Default value 1. Specifies whether to send the `Node` field to the parent event journal.
`CEAJournalSummary`	Default value 1. Specifies whether to send the `Summary` field to the parent event journal.
`CEAJournalAlertKey`	Default value 1. Specifies whether to send the `AlertKey` field to the parent event journal.
`CEAJournalCustomText`	Default value 1. Specifies whether to send the `CustomText` field to the parent event journal.
`CEAMaxSiteNameJournals`	Default value 10. Specifies maximum number of events to send to the `SiteNameParent` event journal.
`CEAMaxCKeyJournals`	Default value 50. Specifies maximum number of events to send to the `CEACorrelationKeyParent` event journal.
`CEAMaxSuperParentJournals`	Default value 100. Specifies maximum number of events to send to the super parent event journal.

The following table contains properties that relate to how the events are processed and updated after grouping is done at the ScopeIDParent level.

Table 4. Post-grouping properties in the master.cea_properties table
Property group	Property	Description
Dismantling properties	`CEAMinimumChildren`	Default value 0. Property type integer. This property specifies the minimum size of a grouping in terms of how many child events it has. If a grouping is present beyond its expiry time and does not have this minimum number of child events, the grouping is dismantled. The dismantle process involves unlinking the child events from the synthetic parent events. The synthetic parent events then auto-clear, since they no longer have any children. The underlying child events stand on their own in the ObjectServer. IBM Netcool Operations Insight on Red Hat OpenShift updates the `CEACorrelationKey` parameter for events when it sees two events that should be grouped. The SQL triggers delay synthetic parent creation to two children, if the value of the `CEAParentCreationType` parameter equals two. There is no way to delay the creation of a synthetic parent until more than two children exist. This property is only concerned with dismantling groups. If the `CEAMinimumChildren` value is increased, then the `cea_dismantle_small_groups` procedure clears parents with less than the `CEAMinimumChildren` number of children. The number of children is determined from the Poll field of the parent. But, the Poll field is only set if Journalling is enabled. Journalling is enabled when `CEAJournalToCKeyParent` and `CEAJournalToSuperParent` are set to 1. Increase `CEAMinimumChildren` from the default value (0), only if journalling is enabled. If journalling is disabled, dismantling of groups will not happen.
	`CEAMinimumCKeyTTL`	Default value 120. Specifies the minimum time to live of `CEACorrelationKeyParent` events that are used by the minimum children automation.
	`CEAClearTTNumber`	Default value 0. Specifies that the inherited ticket number should be cleared from children if dismantling.
	`CEADismantleSingleMemberGrps`	Default value 0. Specifies whether a group is dismantled immediately when it has only one member (disabled is 0). Any nonzero value means enabled.
Properties that affect the synthetic records, like the `ScopeIDParent` record summary field.	`CEACKeyPrefix`	Specifies what the `CEACorrelationKey` prefix should be, if included in the `CEACorrelationKeyParent` summary field.
	`CEAUseCKeyLabel`	Specifies whether to append the `CEACorrelationKey` prefix to the `CEACorrelationKeyParent` summary field.
	`CEAUseCKeyImpactCause`	Specifies whether to append the impact and cause text to the `EGCorrelationKeyParent` summary field. This property is only of use if there are child events directly under the `CEACorrelationKeyParent` event. It does not look at child events that are contained under `SiteNameParent` subgroups.
	`CEAUseCKeySitesAffected`	Specifies whether to append the number of sites affected text to the `CEACorrelationKeyParent` summary field.
	`CEACKeySitesAffectedLabel`	Specifies the label to use when referring to the number of subgroups affected in the `CEACorrelationKeyParent` summary field. The default label is site.
	`CEAUseCKeyPrefix`	Specifies whether to append the `CEACorrelationKey` prefix to the `CEACorrelationKeyParent` summary field.
The `CEAUseCKeyNumActiveAlarms` and `CEACKeySummaryActiveFirst` properties work together. When `CEACKeySummaryActiveFirst` is enabled, the number of active alarms is displayed at the start of the summary instead of at the end.	`CEACKeySummaryActiveFirst`	Specifies whether the number of active alarms appears at the start of the `CEACorrelationKeyParent` summary. A value of zero means disabled.
	`CEAUseCKeyNumActiveAlarms`	Specifies whether to append the number of active alarms text to the `CEACorrelationKeyParent` summary field.

Draft comment: DEIRDRELAWTON
Removed Table 5 with SiteName properties that should not be updated