Configure a Correlation Rule

Tip Configure a Correlation Rule when you want to correlate a Child incident Configuration under a Parent Incident Configuration that is generated by NNMi.

Note See HelpDocumentation LibraryRelease Notes, and locate the Support Matrix link for Correlation Rule limitations.

When correlating groups of incidents under an existing Parent incident, use the Correlation Rules tab to specify the Correlation Rule that defines the Parent Incident, the Child Incident, and the relationship requirements that must be met before the incidents are correlated.

See Correlation Rule Example for a step-by-step example of how the Subinterface Custom Correlation Rule provided by NNMi was created.

For information about each Correlation Rules tabConcept Link IconSee Also

To configure a Correlation Rule:

  1. Navigate to the Correlation Rules tab.
  2. From the Correlation Rules table toolbar, do one of the following:

    • To create a Correlation Rule, click the New icon, and continue.
    • To edit a Correlation Rule, click the Open icon in the row representing the Correlation Rule you want to edit, and continue.
    • To delete a Correlation Rule, click the  Delete icon.
  3. Create your Correlation Rule (see table).
  4. Click  Save and Close to save your changes and return to the previous form.
Correlation Rule Basic Attributes
Attribute Description
Name

Type a maximum of 64 characters. Alpha-numeric, spaces, and special characters (~ ! @ # $ % ^ & * ( ) _+ -) are permitted.

The name is used to identify the Correlation Rule and must be unique. Use a name that will help you to remember the purpose of the Correlation Rule.

Author

Indicates who created or last modified the Correlation Rule.

If the Author attribute value is Network Node Manager, any changes are at risk of being overwritten in the future.

  • Click  Lookup and select  Show Analysis to display details about the currently selected Author.
  • Click  Quick Find to access the list of existing Author values.
  • Click  New to create an Author value.
Enabled

If  enabled, the NNMi Causal Engine uses the Correlation Rule when evaluating incidents.

If   disabled, the Correlation Rule is ignored.

Parent Incident

Specifies the incident configuration that should be used as the Parent Incident for the Correlation Rule.

Note If you want to create a rule to generate a Parent Incident configure a Causal Rule. See Configure a Causal Rule for more information.

To specify a Parent Incident configuration:

  1. Click the Lookup icon, and do one of the following:

    • To display Analysis Pane information, select Show Analysis.
    • To display the list of possible incidents, select Quick Find. In the Quick Find dialog, select the Incident of interest.
    • To create a Parent Incident, select one of the following:

      • New Management Event Configuration
      • New Remote NNM Event Configuration
      • New SNMP Trap Configuration
    • To modify a Parent Incident, select Open.
  2. Optional. To create or modify a Parent Incident, enter or modify the attribute values for the selected Incident configuration. See Configure Incidents for more information about the Incident Configuration form.
  3. Click  Save and Close to save your changes and return to the previous form.
Child Incident

Specifies the incident configuration that must match an incoming incident and that should be correlated as the Child Incident for the Custom Correlation.

To specify a Child Incident configuration

  1. Click the Lookup icon, and do one of the following:

    • To display Analysis Pane information, in the Quick Find dialog, select Show Analysis.
    • To create a Child Incident, select one of the following:

      • New Management Event Configuration
      • New Remote NNM Event Configuration
      • New SNMP Trap Configuration
    • To modify a Child Incident, select Open.
  2. Optional. To create or modify a Child Incident, enter or modify the attribute values for the selected Incident configuration. See Configure Incidents for more information about the Incident Configuration form.
  3. Click  Save and Close to save your changes and return to the previous form.
Correlation Window Duration

The time window within which NNMi begins to correlate the incidents. Enter a number for Days, Hours, Minutes, and Seconds.

Note the following:

  • If the Parent and Child incidents occur within the Correlation Window Duration specified, NNMi begins to correlate the incidents as soon as they occur.
  • If you are relating multiple Custom Correlations, make sure the Correlation Window Duration allows enough time for all of the Parent and Child incidents to be generated. For example, when correlating a trap and an Interface Down incident on an interface that is polled every 5 minutes, use a 6-minute Correlation Duration Window to guarantee that the trap on the Interface Down occurs in the same Correlation Window Duration. This is because It might take up to 5 minutes for the associated Interfaced Down incident to occur

    Note This example assumes that if the Interface Down occurs before the trap, the trap is sent within 6 minutes of the Interface Down Incident.

  • A lengthy Correlation Window Duration can increase memory usage and subsequently affect NNMi performance. When using a long duration window, the more often the incident occurs, the greater the affect on memory. To avoid possible performance issues, use a shorter duration for incidents that occur more frequently.

Description

Use the description field to provide additional information that you would like to store about the current incident configuration. This description applies only to the configuration entry.

Type a maximum of 2048 characters. Alpha-numeric, spaces, and special characters (~ ! @ # $ % ^ & * ( ) _+) are permitted.