About Event Analytics

Edit online

Within Event Analytics, you can determine seasonality of events (using the seasonality algorithm), and determine which events tend to occur together (using the related event group, or event pattern algorithms).

Seasonal events

Event Analytics uses statistical analysis of IBM® Tivoli® Netcool®/OMNIbus historical event data to determine the seasonality of events, such as when and how frequently events occur. The results of this analysis are output in both reports and graphs.

The data that is presented in the event seasonality report helps you to identify seasonal event patterns within their infrastructure. For example, an event that periodically occurs at an unscheduled specific time is highlighted. Seasonal Event Rules are grouped by state in the Seasonal Event Rules portlet. You can
  • Use the View Seasonal Events UI to analyze seasonal events and associated related events.
  • Deploy validated seasonal event rules, without writing new code. Rules that are generated in this way can have various actions applied to them.

Related event groups

Event Analytics uses statistical analysis of Tivoli Netcool/OMNIbus historical event data to determine which events have a statistical tendency to occur together. Event Analytics outputs the results of this statistical analysis as event groups, on a scheduled basis. You can:
  • Use the related events UI to analyze these event groups.
  • Deploy validated event groups as Netcool/Impact correlation rules with a single click, without the need to write any code. Correlation rules that are generated in this way act on real-time event data to show a single synthetic event for the events in the event group.
  • Present all events in the group as children of this synthetic event. This view decreases the number of events displayed to your operations staff in the Event Viewer.
  • Use the Related Event portlet to analyze patterns in groups and deploy correlation rules based on common event types between the groups.

The system uses the most actionable event in the group as the parent event to be set by the correlation rule. By default, the most actionable event in the group is the most ticketed or acknowledged event. Before you deploy the correlation rule, you can change the parent event setting. A synthetic event is created with some of the properties of the parent event, and all the related events are grouped under this synthetic event.

Event groups are generated by scheduled runs of related event configurations. A default related event configuration is provided. You can create your own configurations and specify which historical data to analyze. For example, you can specify a custom time range, an event filter, and schedule.

For more information about related events, see Related events.

Event patterns

In contrast to ungrouped deployed based on related event groups, the use of patterns allows events with different Identifier fields to be grouped in the Event Viewer. In this case, incoming events are matched by using the Event Type field. Matching events for deployed patterns are grouped by Resource in the Event Viewer. To allow a group of related events, with different Resource field values, to be allocated to a pattern, use name similarity or specify a regular expression in the pattern. To allow deployed patterns to group events across multiple resources, use name similarity or specify a regular expression in the pattern.

You can create a pattern based on the related event groups discovered by the related event analytic. The system can also suggest name patterns to you based on the related event groups discovered by the related event analytic. You can use an event in the group as the parent event to be set by the correlation rule, or create a synthetic event as the parent. You can also test the performance of a pattern before it is created to check the number of related events groups and events returned for a pattern.

For more information about event patterns, see About event patterns.