09-24-2010 04:28 AM
We are running a version 9 of NNMi.
At a certain point I would like to create a new correlation to do the following :
When a incident InterfaceDown is coming I would like that the system keep this in the queue for 3-4min waiting for an NodeDown incident, if NodeDown comes, then only NodeDown is displayed/generated (InterfaceDown correlated under NodeDown).
If after 3-4 min no NodeDown incident comes, then the InterfacesDown are generated.
I tried with Dampening and Correlation Rules, but I wasn't able to create this.
Any help would be greatly appreciated
Thanks per advance
09-28-2010 04:43 AM
Its not possible to just correlate the interface down event under the parent event, neither can PairWise be used since this will close the events.
One way this can be achieved is to use a "Causal Rule" under the "Customer Correlation" configuration. Causal rules can generate a new incident and then correlate one or more child events under it. The trick to using them effectively is to use the "Open Key Incidents" view to see the incidents you want to manage. However this does rely on generating a new event which in effect replaces the Node Down event in the display.
Here is how to set things up:
1) Create a new management incident that is configured to be a "key incident" and displays the Node Down infromation you wish to see. Also specify the time period for the correlation.
2) Create a causal rule that specifies the above incident to be generated and is has a correlation nature of "Root Cause"
3) Under the child incidents configure the Node Down incident to be a "required child" - so don't check the box, and check the two "Source" boxes. You will need to specify a child filter attribute to ensure all the events are related to the same device.
4) Add the Interface down incident as a child filter but make it an optional child - so check the box.
5) add any other child incidents you may want to include in the correlation
What the results should be is that if the node down incident comes in then the new Causal incident will be generated and the node down incident and any other child incidents within the window period will be correlated under it. In the key incidents view you will only see the Causal incident. However, if the Node Down incident does not come in then you will see the child incidents in the key incidents view ( if so configured ).
You may want to tune this configuration to match your exact needs, but I hope it helps to achieve what you are after.
All the best
The views expressed in my contributions are my own and do not necessarily reflect the views and strategy of HP
If you find this or any post resolves your issue, please be sure to mark it as an accepted solution.