About analytics
Read this document to find out more about analytics, including temporal correlation, seasonality, and probable cause.
Temporal correlation
Temporal correlation helps you to reduce the noise by grouping events, which share a temporal relationship. Event correlation policies are created, allowing temporal correlation to be applied to subsequent events that match the discovered temporal profile. Click Administering policies created by analytics to read more about policies and how to review them. Temporal correlation is based on two capabilities:
- Temporal grouping: the temporal grouping analytic identifies related events based on their historic co-occurrences. Subsequent events, which match the temporal profile are correlated together. With temporal grouping, you can choose the policy deployment mode that can be Deploy first or Review first. In Deploy first mode, policies are enabled automatically, without the need for manual review. In Review first mode, policies are not enabled until they are manually reviewed and approved.
- Temporal patterns: the temporal pattern analytic identifies patterns of behavior among temporal groups, which are similar, but occur on different resources. Subsequent events, which match the pattern and occur on a new, common resource are grouped together.
Seasonality
Seasonal event enrichment helps you to identify events in your environment, which consistently occur within a seasonal time window. The seasonal event analytic identifies these characteristics on based on historical event occurences. Seasonal events are enriched with a seasonal indicator, which displays whether an event occurred in, or outside of, an expected seasonal period.
- Hour of the day
-
Between 12:00 and 1:00 pm - Day of the week
-
On Mondays - Day of the month
-
On the 3rd of the month - Day of the week at a given hour
-
On Mondays, between 12:00 and 1:00 pm - Day of the month at a given hour
-
On the 3rd of the month, between 12:00 and 1:00 pm
Click Configuring seasonality to learn how to configure seasonality and Displaying event seasonality to see how seasonal enrichment of events is displayed to your operations team in the Events page.
Probable cause
probable cause capability is designed to identify the event with the greatest probability of being the cause of the event group, by analyzing the topological information within the events. Learn more about probable cause as part of the Netcool® Operations Insight® installation.
Click Configuring probable cause to learn how to configure probable cause and Displaying probable cause for an event group to see how probable cause data is displayed to your operations team in the Events page.
Topological correlation
You can create topology templates to generate defined topologies, which search your topology database for instances that match its conditions. Operators see events that are grouped by topology based on these topology templates.
Click Configuring topological correlation to learn how to configure topological correlation and click Displaying analytics details for an event group to see how topological event groups are displayed to your operations team in the Events page.
Scope-based grouping
The scope-based event grouping capability groups events that come from the same place around the same time as it's most likely that these events relate to the same root problem. Operators see events that are grouped by scope based on the scope-based groups that are configured. You can define the scope as any one of the event columns; typical examples of scope are the Node or Location columns.
Click Configuring scope-based grouping to learn how to configure scope-based grouping and Displaying analytics details for an event group to see how scope-based event groups are displayed to your operations team in the Events page.