About alert groups

Edit online

An alert group is a group of two or more alerts that Netcool® Operations Insight® has correlated together because the underlying analytics have determined that these alerts belong together.

Alerts can be added to an alert group because of one or more of these factors:
Factor Example
Based on alert history, these alerts tend to occur within a short time of each other A Latency alert on a server is regularly followed by a Ping response time high alert on that same server. These alerts are grouped into a temporal Temporal group icon subgroup.
The alerts occur on resources within a predefined section of your network topology If there is a predefined section of the network that groups together a specific switch and all the nodes that depend on that switch, then any alerts occurring on that specific switch or the nodes connected to it are grouped together. These alerts are grouped into a topological Topological group icon subgroup.
The alerts occur on a user defined scope An administrator defines a scope based on the Node column. Any alerts that match the scope and occur within a default time window are then automatically grouped together. An example would be where an alert storm occurs on the london145.acme.com server. All of the alerts in that storm will be grouped together as they match the scope Node= london145.acme.com, and they occur within the default time window. These alerts are grouped into a scope-based Scope-based group icon subgroup.
Note: The cloud native analytics scope based grouping is not the same as the traditional scope based grouping that is provided with the base WebGUI deployment. The cloud native analytics scoping policies is the new method with which to do scope based grouping. The legacy scope based grouping screen available in the on premises deployment of WebGUI provides the means of defining which columns of the alert form the scoping id and is used by the non-cloud based event analytics scoping system. However, the new cloud native analytics scoping policy can support any enrichment from the legacy policies that enrich the ScopeID column.