Using human-in-the-loop probable cause analysis functionality

Human-in-the-loop probable cause analysis functionality allows you to manually intervene in the analysis of the probable causes of events.

Automatically calculating the probable cause using the Impact service

The Impact service has a server named ProbableCauseAnalysisV2EventReader which automatically calculates the probable cause of an event. By default, this service is set to not running.

Start the ProbableCauseAnalysisV2EventReader service to automatically calculate the probable cause for any existing, new, or updated groups. The service runs every minute, but can be configured to run at any interval.

You can edit the filter criteria to run the service against specific groups and events.

Manually running the probable cause for all groups exist in the ObjectServer

The Impact project has a policy named ProbableCauseAnalysisV2ManualRun which allows you to calculate the probable cause for every group that exists in the ObjectServer.

You can edit the filter criteria to run the policy against specific groups and events.

Manually recomputing the probable cause for a group

To manually recompute the probable cause for a group:

  1. Login to WebGUI and open the Event Viewer.

  2. Switch the view to Example_IBM_CoudAnalytics or to a similar view so that you can see grouped events.

  3. Right-click on an event or a parent event, select the menu EventManagementAnalyticsTool and select Recomputable.

    The tool will execute the Impact operator view to trigger the policy to recompute the probable cause.

Setting the probable cause keywords from a selected event using the WebGUI right-click tool

To set the probable cause keywords from a selected event:

  1. Login to WebGUI and open the Event Viewer.

  2. Switch the view to Example_IBM_CoudAnalytics or a similar view so that you can see grouped events.

  3. Right-click on an event or a parent event, select the menu EventManagementAnalyticsTool and select SetProbableCauseKeyword.

    The tool will launch the Impact operator view for keywords configuration and highlights the selected events data: Serial, Summary, and AlertGroup.

Additional tools for managing the probable cause with human-in-the-loop functionality

The following tools are available:

  1. ExcludeFromProbableCauseRecompute for excluding an event(s) from recomputing the probable cause.

  2. IncludeInProbableCauseRecompute for including an excluded event in the probable cause calculation.

  3. WhatAssignedProbableCause for showing how the probable cause was calculated. This shows whether the probable cause was calculated by the right click tool, set manually, or calculated by the default topological grouping calculation.

Journal entries

The Impact policy adds an entry to the event journal indicating that the probable cause was calculated by the policy.

The Event Viewer SetProbableCauseValue right-click tool adds an entry indicating that the probable cause was calculated by the right-click tool.