Customizing probable cause
Learn how to customize probable cause.
Probable-cause analysis is performed in Netcool® Operations Insight® automatically for events that have been grouped by a topological association.
Included within IBM® Tivoli® Netcool/Impact is a policy and service that allows you to perform probable-cause analysis for other types of grouped events. You can also modify the weightings applied for the different criteria and add custom keywords, which are important to your organization.
The policy and service work by adding boost points to the probable cause score, based on various criteria. The child event that results in the highest number of points overall is deemed to be the most likely probable cause event in the group of child events. If two or more child events result in the same overall score, they are all reflected in the UI with blue bars, indicating that they are all equally likely probable causes.
The summary value, which gets propagated up to the summary field of the group synthetic parent event, is automatically copied from the child event with the highest probable cause score. Where more than one event has the highest probable cause score, the child event it selects for this purpose is indeterminate.
The Netcool/Impact project,
EventManagementAnalytics, has the relevant policy and service.
Steps to customize the probable cause
1. Locate the policy by selecting.
- What the initial Severity is
- If the event has the first
FirstOccurrenceof the group
- If Network Manager has marked it as a root cause (
- Keywords in the summary field
- If it is available, adds on scope-based event grouping
- DatasourceName: By default, your datasource name is
defaultobjectserver. Only modify this property if you are making a copy of the policy to run against a different ObjectServer datasource.
- ProbableCauseField: By default, this parameter is set to
CEAEventScore. This value is correct for Netcool Operations Insight systems. If this policy was applied to an on-premises environment, where only scope-based grouping is present, the value can be changed to
- ParentAlertGroup: By default, this parameter is set to
CEACorrelationKeyParent. This value is correct for Netcool Operations Insight systems. If this policy was applied to an on-premises environment, where only scope-based grouping is present, the value can be changed to
- ProcessingDelay: Probable cause analysis is done once only per event in Netcool Operations Insight, except for parent events. A processing delay is introduced into the probable-cause analysis process to allow for Netcool Operations Insight probable cause and Network Manager Root Cause Analysis (RCA) to run first. This delay is important because the Netcool/Impact policy boosts the probable cause score field with additional points based on this analysis happening first. The default processing delay is 60 seconds.
- BatchSize: This property specifies how many child events Netcool/Impact should attempt to process each time the policy runs, by default every 13 seconds. The default value for this advanced property is 1000 events per run.
- Severity score boost: Child events get allocated probable cause points
based on their initial severity. The following values are the default values:
- Severity 1 (Indeterminate): 10 points
- Severity 2 (Information): 20 points
- Severity 3 (Minor): 30 points
- Severity 4 (Major): 40 points
- Severity 5 (Critical): 50 points
- Severity 6 (Fatal): 60 points
- FirstEventBoost: A child event in a group of events that has the earliest FirstOccurrence timestamp is boosted by 100 points. Where two or more child events have the same first FirstOccurrence value, the one with the lowest Serial value is selected, the event received first by Netcool Operations Insight.
- ITNMRootCauseBoost: Any child events that are marked by Network Manager
as a root cause event are boosted by 110 points. This field is indicated by Network Manager setting
NmosCauseTypefield to 1.
- SummaryKeywords: The SummaryKeywords table has a list of keywords that are indicative that an event is a probable cause of a problem. Each entry contains a keyword of interest, whether it is case sensitive (0 means no, 1 means yes), and how many score boost points this word or phrase is worth, if present. The policy comes out-of-the-box with a list of commonly occurring keywords and predefined scores. As well as being able to tweak the values assigned for the existing list of keywords, you can also add your own keywords and relative score booster values. The overall score is boosted for each keyword or phrase present by the number of points indicated in each case. The score is cumulative and will receive points for each one present.
- AddSBEGCauseWeight: Standalone, or on-premises IBM
Netcool/OMNIbus systems that use scope-based
event grouping can have
CauseWeightimplemented in existing probes or triggers. If this logic is present, the system automatically boosts the probable cause score by any score present in the
CauseWeightfield. To disable this behavior, set this property to disabled (0). The default setting is enabled (1).
3. Locate the corresponding service by selecting. This policy activator service is configured to run every 11 seconds.
4. Edit the service. The service can be edited and configured to start automatically when the Netcool/Impact server starts. Click Start Service (green play button) to start this service.