Concepts for Incidents

NNMi collects network status information from the following sources:

• The NNMi Causal Engine analyzes the health of your network and provides the ongoing health status reading for each device. The Causal Engine also extensively evaluates and determines the root cause of network problems whenever possible.
• SNMP traps from network devices. The NNMi Causal Engine uses this information as symptoms during its analysis.
• Syslog messages from ArcSight Logger integration.

NNMi converts this network status information into incidents that provide useful information for managing the network. NNMi provides many default incident correlations that reduce the number of incidents for network operators to consider. You can customize the default incident correlations and create new incident correlations to match the network management needs of your environment.

The incident configurations in the NNMi console define the incident types that NNMi can create. If no incident configuration matches a received SNMP trap syslog message, that information is discarded. If the management mode of the source object is set to NOT MANAGED or OUT OF SERVICE in the NNMi database, or if the device is not monitored for fault polling, NNMi always discards the incoming trap.

Additionally, NNMi discards SNMP traps from network devices that are not in the NNMi topology. For information about changing this default behavior, see Handle Unresolved Incoming Traps in the NNMi help.

??At some point, need to talk about where discarded traps go to die. tuning section??

Concepts for Incidents shows the flow of information into and out of the NNMi event pipeline.

High-Level NNMi Event Architecture

??Kevin has this drawing??

For more information, see the following:

• About the Event Pipeline in the NNMi help
• The NNMi Causal Engine and Incidents in the NNMi help

• Network Node Manager i Software Causal Analysis White Paper, available from

  http://h20230.www2.hp.com/selfsolve/manuals