Customizing probable cause

Edit online

Learn how to customize probable cause.

Probable-cause analysis is performed in Netcool® Operations Insight® automatically for events that have been grouped by a topological association.

Included within IBM® Tivoli® Netcool/Impact is a policy and service that allows you to perform probable-cause analysis for other types of grouped events. You can also modify the weightings applied for the different criteria and add custom keywords, which are important to your organization.

The policy and service work by adding boost points to the probable cause score, based on various criteria. The child event that results in the highest number of points overall is deemed to be the most likely probable cause event in the group of child events. If two or more child events result in the same overall score, they are all reflected in the UI with blue bars, indicating that they are all equally likely probable causes.

The summary value, which gets propagated up to the summary field of the group synthetic parent event, is automatically copied from the child event with the highest probable cause score. Where more than one event has the highest probable cause score, the child event it selects for this purpose is indeterminate.

The Netcool/Impact project, EventManagementAnalytics, has the relevant policy and service.

Steps to customize the probable cause

1. Locate the policy by selecting Automations > Netcool Impact > Policies > ProbableCauseAnalysis.

The policy does probable cause analysis based on the following criteria:
  • What the initial Severity is
  • If the event has the first FirstOccurrence of the group
  • If Network Manager has marked it as a root cause (NmosCauseType = 1)
  • Keywords in the summary field
  • If it is available, adds on scope-based event grouping CauseWeight
2. (Optional) Edit the policy. The first section of the policy contains the following user-modifiable parameters.
Note: The policy can be used without modification, using the default settings.
  • DatasourceName: By default, your datasource name is defaultobjectserver. Only modify this property if you are making a copy of the policy to run against a different ObjectServer datasource.
  • ProbableCauseField: By default, this parameter is set to CEAEventScore. This value is correct for Netcool Operations Insight systems. If this policy was applied to an on-premises environment, where only scope-based grouping is present, the value can be changed to CauseWeight.
  • ParentAlertGroup: By default, this parameter is set to CEACorrelationKeyParent. This value is correct for Netcool Operations Insight systems. If this policy was applied to an on-premises environment, where only scope-based grouping is present, the value can be changed to ScopeIDParent.
  • ProcessingDelay: Probable cause analysis is done once only per event in Netcool Operations Insight, except for parent events. A processing delay is introduced into the probable-cause analysis process to allow for Netcool Operations Insight probable cause and Network Manager Root Cause Analysis (RCA) to run first. This delay is important because the Netcool/Impact policy boosts the probable cause score field with additional points based on this analysis happening first. The default processing delay is 60 seconds.
  • BatchSize: This property specifies how many child events Netcool/Impact should attempt to process each time the policy runs, by default every 13 seconds. The default value for this advanced property is 1000 events per run.
  • Severity score boost: Child events get allocated probable cause points based on their initial severity. The following values are the default values:
    • Severity 1 (Indeterminate): 10 points
    • Severity 2 (Information): 20 points
    • Severity 3 (Minor): 30 points
    • Severity 4 (Major): 40 points
    • Severity 5 (Critical): 50 points
    • Severity 6 (Fatal): 60 points
  • FirstEventBoost: A child event in a group of events that has the earliest FirstOccurrence timestamp is boosted by 100 points. Where two or more child events have the same first FirstOccurrence value, the one with the lowest Serial value is selected, the event received first by Netcool Operations Insight.
  • ITNMRootCauseBoost: Any child events that are marked by Network Manager as a root cause event are boosted by 110 points. This field is indicated by Network Manager setting the NmosCauseType field to 1.
  • SummaryKeywords: The SummaryKeywords table has a list of keywords that are indicative that an event is a probable cause of a problem. Each entry contains a keyword of interest, whether it is case sensitive (0 means no, 1 means yes), and how many score boost points this word or phrase is worth, if present. The policy comes out-of-the-box with a list of commonly occurring keywords and predefined scores. As well as being able to tweak the values assigned for the existing list of keywords, you can also add your own keywords and relative score booster values. The overall score is boosted for each keyword or phrase present by the number of points indicated in each case. The score is cumulative and will receive points for each one present.
  • AddSBEGCauseWeight: Standalone, or on-premises IBM Tivoli Netcool/OMNIbus systems that use scope-based event grouping can have CauseWeight implemented in existing probes or triggers. If this logic is present, the system automatically boosts the probable cause score by any score present in the CauseWeight field. To disable this behavior, set this property to disabled (0). The default setting is enabled (1).

3. Locate the corresponding service by selecting Automations > Netcool Impact > Services > ProbableCauseAnalysis. This policy activator service is configured to run every 11 seconds.

4. Edit the service. The service can be edited and configured to start automatically when the Netcool/Impact server starts. Click Start Service (green play button) to start this service.