Configuring multiple resource columns

Learn how to configure multiple resource columns.

About this task

The repattern_multiresource_correlation_logic parameter is used to determine how multiple resources are checked for inclusion in a pattern. It also controls how events with similar resources are grouped together in the Event Viewer. If resource values are similar, then the corresponding events are grouped together in a single event group in the Event Viewer. Within EA a similar resources can be any of the following:

Exact match: this is the default setting. The resource names must match exactly.
Regular expression: you can define a regular expression to group together resources that match the regular expression.
Name similarity: you can configure the system to use the name similarity mechanism. This mechanism determines whether two resource names are similar using a pattern matching algorithm that uses predefined parameters. For example, the first three characters in the resource name must be the same, or the last three characters in the resource name must be the same.

The repattern_multiresource_correlation_logic parameter is configured with the OR value by default. Use this procedure to change the setting.

Only change the repattern_multiresource_correlation_logic setting if you understand the effects that this change will have on how the resulting groups are presented in the Event Viewer. When OR logic is specified, it correlates two events by resource as soon as the pattern is met for just one resource. When AND logic is specified, only "Exact match" resource matching is used and the criteria must be met for all of the resource values.

Note: If one resource field is selected per event type, the resource fields for each event type can be different. In this case AND logic is the same as OR logic. If more than one resource field is selected, the resource fields for each event type must be the same.

Note: Suggested patterns only use one resource field. They are never generated with multiple resources.

Procedure

Generate a properties file containing the latest Event Analytics system settings.
1. Navigate to the directory $IMPACT_HOME/bin.
2. Run the following command to generate a properties file containing the latest Event Analytics system settings.
```
nci_trigger server_name username/password NOI_DefaultValues_Export
 FILENAME directory/filename
```
  Where:
  - server_name is the name of the server where Event Analytics is installed.
  - user name is the user name of the Event Analytics user.
  - password is the password of the Event Analytics user.
  - NOI_DefaultValues_Export is a Netcool®/Impact policy that performs an export of the current Event Analytics system settings to a designated properties file.
  - directory is the directory where the properties file is stored.
  - filename is the name of the properties file.
  For example:
```
nci_trigger NCI impactadmin/impactpass NOI_DefaultValues_Export
 FILENAME /tmp/properties.props
```
Edit the properties file that you generated in the previous step.
For example:
```
vi /tmp/properties.props
```
Find the section of the properties file that reads as follows:
This code snippet shows the default values of the name similarity parameters.
```
repattern_multiresource_correlation_logic=OR
```

Update the repattern_multiresource_correlation_logic setting, as described in the following table.

Table 1. `repattern_multiresource_correlation_logic` setting
Parameter	Description	Values
`repattern_multiresource_correlation_logic`	Specifies whether to include multiple resource columns when performing pattern matching: `OR`: Default value. Applied when the criteria is met for just one pattern resource definition. `AND`: Applied when the criteria is met for all pattern resource definitions. Only "Exact match" resource matching is used for AND logic. If you specify AND logic, then you cannot specify regular expression or name similarity as the mechanism for matching the resource information from the multiple selected resource columns.. Note: If you configure `AND` logic, and an event comes in with any one of its multiple resource columns set to NULL, then that event is automatically excluded from pattern processing.	Possible values: `OR` `AND` Default value: `OR`

Import the modified properties file into Event Analytics.
1. Ensure you are in the directory $IMPACT_HOME/bin.
2. Run the following command to perform an import of Event Analytics system settings from a designated properties file.
```
nci_trigger server_name username/password NOI_DefaultValues_Configure
 FILENAME directory/filename
```
  Where:
  - server_name is the name of the server where Event Analytics is installed.
  - user name is the user name of the Event Analytics user.
  - password is the password of the Event Analytics user.
  - NOI_DefaultValues_Configure is a Netcool/Impact policy that performs an import of Event Analytics system settings from a designated properties file.
  - directory is the directory where the properties file is stored.
  - filename is the name of the properties file.
  For example:
```
nci_trigger NCI impactadmin/impactpass NOI_DefaultValues_Configure
 FILENAME /tmp/properties.props
```