How to create event correlation on OMi? (490 Views)
Reply
Regular Advisor
Anders Nilsson
Posts: 160
Registered: ‎09-13-2005
Message 1 of 10 (490 Views)
Accepted Solution

How to create event correlation on OMi?

[ Edited ]

I've spend quite some time trying to figure out how to create correlation circuit on OMi and the more I'm working on it, the more I'm confused. Can anybody provide some step by step instructions?

I.e. I have 2 type of alarms to be correlated and 1 to be a root cause and the second to be a symptom. Let's say:

1. Service ABC is down

2. And because of that, the "Process 123 is down"

 

Once "2" event comes after event "1" (let's say within 1 minute), supress event "2" since that's a symptom of problem, which is presented in event "1".

 

Events are forwarded from  OML/OMW and on template level I already setup CMA, where created EventTypeIndicator="ServiceABC:Down" on 1st event and EventTypeIndicator="Process123:Down". So far, I'm able to see these events on OMi event bwowser, where ETI field is empty, but "ETIHint" field has these values "ServiceABC:Down" and "Process123:Down".

So my assumption is that I don't have such ETIs assigned to CI (or something like this), but I couldn't find the way to do so.

Can somebody give any recommendations/explanation, or ideally step-by-step instructions how to configure that correlation?

 

Note: I have fresh OMi installation, so no more effort rather than default config in terms of CI list is being made.

 

 

P.S. This thread has been moevd from Application Perf Mgmt (BAC / BSM) Support and News Forum to Systems Management (OpenView-OP Mgmt) Support and News Forum - Hp Forums moderator

Please use plain text.
HP Expert
Asaf Shechter
Posts: 1,089
Registered: ‎12-09-2008
Message 2 of 10 (478 Views)

Re: How to create event correlation on OMi?

Your events were not resolved to CI (or to the correct CI), thus the ETI hints you provided are not used.

Sounds like you are trying to create TBEC rule. for that you need:

T - topology: you need to have your events resolve to CIs, and to the correct CI (Computer, or Service, or Process). this will probably raise a question for you: how do i get CIs in RTSM to be used by OMi, but that's a whole new discussion...

E - events: your events need to have ETI, and hint is not enough...

C - correlation: you need to create a rule in OMi admin. that rule is going to need a RTSM View that has all the CITs you want to correlate.

 

let me know if you need more info,

Asaf

Please use plain text.
Regular Advisor
Anders Nilsson
Posts: 160
Registered: ‎09-13-2005
Message 3 of 10 (454 Views)

Re: How to create event correlation on OMi?

Asaf,

 

Thanks for your response. This moved me one step forward my goal.

And yes, you are correct - I need to create TBEC rule. I tried to play around with correlation rules, but obviously (because of reasons you already mentioned, but it was hard to clearly understand for me at the beginning) I couldn't create it without preparing the whole bunch of things upfront.

At least based on my readings I've done in HP documentation, my ETI hints doesn't convert into ETI because I don't have topology defined. In other words, ETI hint doesn't know where to map that hint to.

So, if my statements above are somewhere close to truth, can you or anybody else (in high level) describe how can I make events to be resolved into CIs. For simplicity purposes, we can assume, my environment consist of 1 managed nodes which has CPU, disk, and network interface, runs one service and depends on one process (in terms of CI granularity).

 

Please use plain text.
HP Expert
Asaf Shechter
Posts: 1,089
Registered: ‎12-09-2008
Message 4 of 10 (448 Views)

Re: How to create event correlation on OMi?

You can start by doing TopoSync from OM into OMi and see the topology which got created for you (note that if you are using InfraSPI you need to change the default sync packages in OMi, but it is well documented).

Then you will send the events again and this time look at the Resolver Hints tab and see if your event resolved to the right CI. again, if you are using the latest InfraSPI, we prepared the policies in such a way that events will resolve to the right CI.

also, please note that by default we dont resolve events to Services and Processes, it is too granular for OMi.

Please use plain text.
Regular Advisor
Anders Nilsson
Posts: 160
Registered: ‎09-13-2005
Message 5 of 10 (440 Views)

Re: How to create event correlation on OMi?

Any way doing it manualy?

One of the reasons, we are still running OS SPI and no Infra SPI is installed. Second - I'm just testing the concept of the TBEC correlation itself, so I assume, defining CI manually would be quicker.

Please use plain text.
Regular Advisor
Anders Nilsson
Posts: 160
Registered: ‎09-13-2005
Message 6 of 10 (430 Views)

Re: How to create event correlation on OMi?

By the way, in order to provide more information where I am:

- Synchronization between OM and OMi seems it's being done and on OMi event I can also see "Related CI" is corresponding to the correct node. Also, just in case I have launched opr-startTopologySync.sh script one more time and it have returned with success message.
- When I look at the event in OMi, I can see following in General tab: Related CI, Source CI.

- Also, in "Resolver Hints" I can see values in following fields: ETI hint, Node hint, Core ID, Source CI hint, etc. By the way, ETI hint is called "Trunk:Failed", while I don't have any "Trunk" definitions in my CI configuration.

 

Another thing, which brought my attention:

- Matched hints condition count is 1 of 4 -> Where that number 4 comes from and why 1 have passed already?

- Status (below "Matched Hints Count): "Success: Classic Hint "Trunk: Omi@@my_node_name" resolved"" (While on OM template I have configured ETI to be "Trunk:Down"

 

 

Thanks in advance for your effort and sharing knowledge.

 

Please use plain text.
HP Expert
Asaf Shechter
Posts: 1,089
Registered: ‎12-09-2008
Message 7 of 10 (428 Views)

Re: How to create event correlation on OMi?

Glad to hear that TopoSync is working for you. please note that you are using the Static TopoSync (OMi pulls from OM) and not the dynamic (OM push into OMi). the latter is the best practice.

OMi uses many hints in order to find the best CI, in your case it looks like the hint from the TopoSync worked. The ETI hint failed since you probably created your own hint in the policy and I am not familiar with any ETI called "Trunk". If you want to use that, you need to create it in OMi Admin > Indicators (or Service Health Admin > Repositories > Indicators, it's the same). the ETI/HI need to be defined against the same CIT that your event got resolved to (probably Node or Computer).

 

It really sounds like you need to take training on OMi concepts... or learn it by the hard way: trial and error.

Please use plain text.
Regular Advisor
Anders Nilsson
Posts: 160
Registered: ‎09-13-2005
Message 8 of 10 (423 Views)

Re: How to create event correlation on OMi?

"Trunk" is my fake name I was playing around to make TBEC rule work based on 2 alarms, where 1 I called "Trunk", another "Customer" in OM policy's custom message attributes (CMA) named EventTypeIndicators.
I agree in regards of training, but that's a pilot to see whether tool (OMi) would bring any valuen into our envirionment. And here we reached the point when I need to say, that I don't agree with HP philosophy - to pull money in anything, like training. I do agree organizaing advanced trainings or some other specialized, but all basics "HOW TOs", I believe should be available. The faster people get the idea of the tool, the more chances they will buy it. But that is slightly outside our topic, so let me work on your suggestions and see where it will get me to.
Please use plain text.
Regular Advisor
Anders Nilsson
Posts: 160
Registered: ‎09-13-2005
Message 9 of 10 (420 Views)

Re: How to create event correlation on OMi?

Asaf,
I just took a quick look at my messages and seems like I'm even more confused:
- Trunk:OMi in Status field (whole value is "Trunk:OMi@@<my_node_name>) is being taken from messsage attributes: one is Object, the other is Application name.
- If I look at the messages, which I generated when I haven't added any CMA on OM policy level, I see that "ETI" and even "ETI Hint" fields are empty, but at the same time, "Matched hint Count" shows 1 of 2 and "Status" says": Success: Classic Hint "c:c@@<my_node_name>" resolved.
I'm entirely confused, what really needs to be done in order to create TBEC rule.
And what brings even more confusion, is that presales guy spend bunch of time repeating how easy and flowless TBEC is being created/maintained/administrated (at the same time didn't bother to show any hands-on example), so we started to believe this tool really may make a trick.
But I still don't want to give up. Need to create at least one correlation rule to make it work and then, when rep will come back, start talking comparing apples to apples.
Please use plain text.
Regular Advisor
Anders Nilsson
Posts: 160
Registered: ‎09-13-2005
Message 10 of 10 (416 Views)

Re: How to create event correlation on OMi?

Asaf,

 

You are GENIUS :)

I made ETI to show up on my event General tab (on OMi).

Many thanks and kudos any other bonuses, thumbs up on this forum are guaranteed. Let me play around with correlation now and come back if I have any questions.

 

Please use plain text.
The opinions expressed above are the personal opinions of the authors, not of HP. By using this site, you accept the Terms of Use and Rules of Participation