Search for	Example	Results
A single word	`cat`	Topics that contain the word "cat". You will also find its grammatical variations, such as "cats".
A phrase. You can specify that the search results contain a specific phrase.	`"cat food"` (quotation marks)	Topics that contain the literal phrase "cat food" and all its grammatical variations. Without the quotation marks, the query is equivalent to specifying an OR operator, which finds topics with one of the individual words instead of the phrase.

Search for	Operator	Example
Two or more words in the same topic	`AND` `and` `+` (plus symbol) `&` (ampersand)	`cat AND dog` `"cat food"+milk` `"cat food"&"dog food"`
Either word in a topic	`OR` `or` `\|` (pipe)	`cat OR dog` `cat \| dog`
Topics that do not contain a specific word or phrase	`NOT` `not` `!` (exclamation point)	`NOT cat` `! dog`
Topics that contain one string and do not contain another	`^` (caret)	`cat ^ mouse`
A combination of search types	`( )` parentheses	`cat + (dog \| mouse)` `cat \| dog + (! mouse)`

Network Node Manager i Software10.30

Administer > Configure Incidents > Manage Incidents Using Incident Configurations > Manage the Number of Incoming Incidents > Establish Criteria or Relationships for Incoming Incidents > Configure a Correlation Rule

Configure a Correlation Rule

Tip Configure a Correlation Rule when you want to correlate a Child incident Configuration under a Parent Incident Configuration that is generated by NNMi.

Note See Help → Documentation Library → Release Notes, and locate the Support Matrix link for Correlation Rule limitations.

When correlating groups of incidents under an existing Parent incident, use the Correlation Rules tab to specify the Correlation Rule that defines the Parent Incident, the Child Incident, and the relationship requirements that must be met before the incidents are correlated.

See Correlation Rule Example for a step-by-step example of how the Subinterface Custom Correlation Rule provided by NNMi was created.

For information about each Correlation Rules tab: See Also

To configure a Correlation Rule:

Navigate to the Custom Correlation Configuration form:
1. From the workspace navigation pane, select the Configuration workspace.
2. Expand the Incidents folder.
3. Select Custom Correlation Configuration.
Navigate to the Correlation Rules tab.
From the Correlation Rules table toolbar, do one of the following:
- To create a Correlation Rule, click the New icon, and continue.
- To edit a Correlation Rule, click the Open icon in the row representing the Correlation Rule you want to edit, and continue.
- To delete a Correlation Rule, click the Delete icon.
Create your Correlation Rule (see table).
Click Save and Close to save your changes and return to the previous form.

Correlation Rule Basic Attributes
Attribute	Description
Name	Type a maximum of 64 characters. Alpha-numeric, spaces, and special characters (~ ! @ # $ % ^ & * ( ) _+ -) are permitted. The name is used to identify the Correlation Rule and must be unique. Use a name that will help you to remember the purpose of the Correlation Rule.
Author	Indicates who created or last modified the Correlation Rule. If the Author attribute value is Network Node Manager, any changes are at risk of being overwritten in the future. Click Lookup and select Show Analysis to display details about the currently selected Author. Click Quick Find to access the list of existing Author values. Click New to create an Author value.
Enabled	If enabled, the NNMi Causal Engine uses the Correlation Rule when evaluating incidents. If disabled, the Correlation Rule is ignored.
Parent Incident	Specifies the incident configuration that should be used as the Parent Incident for the Correlation Rule. Note If you want to create a rule to generate a Parent Incident configure a Causal Rule. See Configure a Causal Rule for more information. To specify a Parent Incident configuration: Click the Lookup icon, and do one of the following: To display Analysis Pane information, select Show Analysis. To display the list of possible incidents, select Quick Find. In the Quick Find dialog, select the Incident of interest. To create a Parent Incident, select one of the following: New Management Event Configuration New Remote NNM Event Configuration New SNMP Trap Configuration To modify a Parent Incident, select Open. Optional. To create or modify a Parent Incident, enter or modify the attribute values for the selected Incident configuration. See Configure Incidents for more information about the Incident Configuration form. Click Save and Close to save your changes and return to the previous form.
Child Incident	Specifies the incident configuration that must match an incoming incident and that should be correlated as the Child Incident for the Custom Correlation. To specify a Child Incident configuration: Click the Lookup icon, and do one of the following: To display Analysis Pane information, in the Quick Find dialog, select Show Analysis. To create a Child Incident, select one of the following: New Management Event Configuration New Remote NNM Event Configuration New SNMP Trap Configuration To modify a Child Incident, select Open. Optional. To create or modify a Child Incident, enter or modify the attribute values for the selected Incident configuration. See Configure Incidents for more information about the Incident Configuration form. Click Save and Close to save your changes and return to the previous form.
Correlation Window Duration	The time window within which NNMi begins to correlate the incidents. Enter a number for Days, Hours, Minutes, and Seconds. Note the following: If the Parent and Child incidents occur within the Correlation Window Duration specified, NNMi begins to correlate the incidents as soon as they occur. If you are relating multiple Custom Correlations, make sure the Correlation Window Duration allows enough time for all of the Parent and Child incidents to be generated. For example, when correlating a trap and an Interface Down incident on an interface that is polled every 5 minutes, use a 6-minute Correlation Duration Window to guarantee that the trap on the Interface Down occurs in the same Correlation Window Duration. This is because It might take up to 5 minutes for the associated Interfaced Down incident to occur Note This example assumes that if the Interface Down occurs before the trap, the trap is sent within 6 minutes of the Interface Down Incident. A lengthy Correlation Window Duration can increase memory usage and subsequently affect NNMi performance. When using a long duration window, the more often the incident occurs, the greater the affect on memory. To avoid possible performance issues, use a shorter duration for incidents that occur more frequently.
Description	Use the description field to provide additional information that you would like to store about the current incident configuration. This description applies only to the configuration entry. Type a maximum of 2048 characters. Alpha-numeric, spaces, and special characters (~ ! @ # $ % ^ & * ( ) _+) are permitted.

Send Help Center feedback