Managing event regrouping

Edit online

One of the key features of Event Analytics is the ability to correlate events together, either based on regular occurrence of the events closely together in time (related events grouping) or based on pattern analysis, and to present these events to the operators in the Event Viewer as an event group. If the parent event within this event group is deleted for any reason, then by default all of the children events become ungrouped. Follow the instructions in this topic to ensure that the events are automatically regrouped

About this task

Netcool®/Impact includes a policy activator service called LookForPatternOrphans. The associated policy regularly checks to see if any event group parent events have been deleted. If it finds that this has occurred, it identifies the orphan events and determines which of these events is the next most important event. It then proceeds to group these events under that next most important event.

To ensure that the LookForPatternOrphans policy activator service picks the most important child event as the new parent in the case of where the two-minute pattern time window has passed and the original parent event has been cleared, you must select a field in the in the ObjectServer alerts.status table to store the pattern name for each event. If this is done, then the LookForPatternOrphans policy activator service will always pick the most important child event.

Procedure

  1. Select a field in the in the ObjectServer alerts.status table to store the pattern name for each event. Then, perform the following steps:
    1. Export the configuration using the command in step 1 of Exporting the Event Analytics configuration.
    2. Modify the exported configuration by adding the following line to the configuration file: 
      pattern_name_field=name_of_selected_field
      Where name_of_selected_field is the name of the field in the in the ObjectServer alerts.status table you selected to store the pattern name for each event
    3. Import the configuration using the command in step 2 of Exporting the Event Analytics configuration.
  2. Activate the LookForPatternOrphans policy activator service.
    1. Log into the Netcool/Impact UI.
    2. Click Services.
    3. Click LookForPatternOrphans from the list of services.
    4. Click Starts automatically when server starts.
    5. Click Save Save icon.