Administer > Configure Incidents > Manage Incidents Using Incident Configurations > Manage the Number of Incoming Incidents > Establish Criteria or Relationships for Incoming Incidents > Configure a Correlation Filter

Configure a Correlation Filter

Note See Help → Documentation Library → Release Notes, and locate the Support Matrix link for Correlation Filter limitations.

When correlating groups of incidents under a Parent incident, you must specify the Correlation Filter that defines the relationship requirements that must be met before the incidents are correlated. The Correlation Filter tab enables you to use the Filter Editor to define these relationship requirements. See Valid Operators in the table that follows for examples of valid Correlation Filters.

Use the Filter Editor Buttons to insert Boolean Operators and to append, insert, and replace expressions in the Filter String. Use the Drag and Drop feature to make changes to the placement of the expressions in your Filter String. ClosedClick here for more information about using the Filter Editor for Custom Correlations:
  • You can use Custom Incident Attributes, attributes for an incident's Source Node or Source Object, or both to define how matching incidents should be considered for the Correlation Rule. See Valid Attributes for more information.
  • When specifying Attribute names and values, NNMi uses the type to determine a match. For example, if the Attribute type is numeric, NNMi does a numeric comparison. If the Attribute type is textual, NNMi does a lexographical string comparison. In all cases, when you use the like or not like operator, NNMi uses a lexographical string comparison. Closed Click here for more information about Attribute types:
    • ifIndex and ifSpeed are numeric Attributes.
    • Any Attribute name that begins wtih "is" (isSnmpInterface, isSnmpNode, isNnmSystemLocal) represents a Boolean Attribute.
    • All other Attributes are textual.
  • Each set of expressions associated with a Boolean Operator (for example, AND) is treated as if it were enclosed in parentheses and evaluated together.
  • View the expression displayed under Filter String to see the logic of the expression as it is created.

  • The AND and OR Boolean Operators must contain at least two expressions.

  • The placement of your cursor and the subsequent text that is selected is important when performing operations using the Additional Filters Editor. For example, you append to or replace, the expression that is selected.
  • The placement of your cursor and the subsequent text that is selected is especially important when adding your Boolean operators. See Add Boolean Operators in the Additional Filters Editor for more information.
    Filter Editor Buttons and Drag and Drop Feature
    Button or Feature Description
    Append Appends the current expression (Attribute, Operator, and Value) to the selected expression already included in the filter string.
    Insert Inserts the current expression (Attribute, Operator, and Value) in front of the cursor location within the Filter String.
    Replace Replaces the selected expression with the expression displayed Left or Right Expression.
    AND

    Inserts the AND Boolean Operator in the selected cursor location.

    Note View the expression displayed under Filter String to see the logic of the expression as it is created.
    OR

    Inserts the OR Boolean Operator in the current cursor location.

    Note View the expression displayed under Filter String to see the logic of the expression as it is created.
    Delete

    Deletes the selected expression.

    Note If the Boolean Operator is selected, the Filter Editor deletes all expressions associated with the Boolean Operator.
    Drag and Drop

    You can drag any of the following items to a new location in the Filter String:

    • Filter Editor Options: AND, OR, NOT, EXISTS, NOT EXISTS
    • Filter Expression (Attribute, Operator, and Value)

    When moving items in the Filter String, note the following:

    • Click the item you want to move before dragging it to a new location.
    • As you drag a selected item, an underline indicates the target location.
    • If you are moving the selection up, NNMi places the item above the target location.
    • If you are moving the selection down, NNMi places the item below the target location.
    • If you attempt to move the selection to an invalid target location, NNMi displays an error message.

See Correlation Rule Example for a step-by-step example of how the Subinterface Custom Correlation Rule provided by NNMi was created.

To configure a Correlation Filter:

  1. ClosedNavigate to the Custom Correlation Configuration form:
    1. From the workspace navigation pane, select the  Configuration workspace.
    2. Expand the Incidents folder.
    3. Select Custom Correlation Configuration.
  2. Navigate to the Correlation Rules tab.
  3. From the Correlation Rules table toolbar, do one of the following:
    • To create a Correlation Rule, click the New icon, and continue.
    • To edit a Correlation Rule, click the Open icon in the row representing the Correlation Rule you want to edit, and continue.
    • To delete a Correlation Rule, click the  Delete icon.
  4. Navigate to the Correlation Filter tab.

  5. Create your Correlation Filter (see Filter Editor Settings).

    Filter Editor Settings
    Setting Description
    Attribute

    The Attribute on which NNMi searches. See Valid Attributes below for a description of valid Attributes.
    Operator Use this Operator to establish the relationship between the Attribute and Expression. See Valid Operators in the table below for the description of each valid Operator.
    Expression

    Use the Expression to complete the criteria for the required relationship between the parent and child incident configurations. See Valid Expressions below for more information.

  6. Click  Save and Close to save your changes and return to the previous form.

Valid Attributes
Attribute Description
Attribute

The Attribute on which NNMi searches. Valid attributes other than Source Node attributes depend on the Incident's Source Object. NNMi checks the Source Node as well as the Source Object for any Capability value.

Note the following when specifying Attributes:

  • Boolean Attributes begin with "is" and must contain the value true or false.

  • Use the following syntax to specify a Custom Incident Attribute (CIA):

    valueOfCia(<CIA_Name>)

    • Check the appropriate Incident form for any valid CIA Names provided by NNMi.

      For example: ${valueOfCia(\Q.1.3.6.1.4.1.9.9.106.2.0.1\E)}= 5

    • When specifying the <CIA_Name>, you can use the syntax defined for Java regular expressions. For example, use the following syntax to specify that you want to include any CIA Name that begins with .1.3.6.1.2.1.31.1.1.1.1.: ${valueOfCia(\Q.1.3.6.1.2.1.31.1.1.1.1.\E.*)}

    • Enclose all CIA names using the \Q and \E characters so that NNMi correctly interprets the period character. For example: ${child.valueOfCia(\Qcia.address\E)}

      For more information, see the Pattern (Java Platform SE6) API documentation at:
      http://download.oracle.com/javase/6/docs/api/java/util/regex/Pattern.html

  • If you use attributes that are valid for the Source Node, NNMi uses the Source Node when comparing values. If you use attributes that are valid for the Source Object, NNMi uses the Source Object when comparing values. You cannot use attributes that are valid for the Source Node and Source Object in the same filter.

  • When using attributes for a Source Object, note the following:

    • When using attributes for a Source Object, the attribute must be valid for the incident's Source Object or NNMi does not find a match. For example, if you use the hostedOn attribute and the Source Object is not an interface, the correlation does not occur.

      Tip To check a Source Object for an incident, select the incident of interest, then select Open from the Lookup menu for the Source Object, and examine the Source Object form.

    • SNMP Trap incidents only. NNMi does not find a match when the value for a Source Object is None. A Source Object attribute value of None indicates that NNMi cannot resolve the Source Object. If you want to match the incident, use one or more Source Node attributes.

  • If the incident does not have a Source Object, a Source Node, or both (for example, the node is not stored in the NNMi database), you must use CIAs in your filter rather than Source Object or Source Node attributes.

    Tip To check whether the Source Object or Source Node is stored in the NNMi database, open the incident and then select Open from the Lookup menu for the Source Node or Source Object displayed. If a form does not open for the selected object or node, this means the source is not stored in the NNMi database.

  • When specifying a Correlation Filter, precede the attribute name with either parent. or child. to specify from which incident the attribute value should be compared. For example, you might specify ${parent.hostedOn} or ${child.ifDesc}.

Possible Source Object choices are as follows:

  • Card Closed [click here for a list of attribute values]

    Unique Keys from the Card Form: Capabilities Tab:

    • capability (Unique Key of the Capability)
  • Interface Closed[click here for a list of attribute values]

    Use the following syntax to specify a Custom Attribute for an Interface:

    valueOfInterfaceCa(<CA_Name>)

    For example: ${child.valueOfInterfaceCA(Role)} =  WAN Connection

    Values from the Basics Attributes listed on the Interface Form:

    • hostedOn (Hosted On Node)

      You must use the full DNS name for the hostedOn value.

    Values from the Interface Form: General Tab:

    • ifName (name configured for the interface)
    • ifAlias (alias configured for the interface)
    • ifDesc (description configured for the interface)
    • ifIndex (index assigned to the interface)

    • ifSpeed (speed configured for the interface)

      When entering the value for ifSpeed, use the actual numeric value for the interface speed. For example, use 10000000 for ifSpeed 10 Mbps.

    Addresses from the Interface Form: IP Addresses Tab:

    • ipAddress (IP Address associated with the interface)

      Because NNMi uses a lexicographical compare when evaluating IP addresses, it is recommended that you use the like and not like operators to specify IP address ranges rather than using the following operators: >, >=, <, or <=.

    Unique Keys from the Interface Form: Capabilities Tab:

    • capability (Unique Key of the Capability)

    Values from the Basics Attributes on the parent Node Form:

    • isSnmpInterface (SNMP Agent Enabled)

    Values from the parent Node Form: General Tab:

    • sysOidInterface (System Object ID)

    Values from the Basics Attributes on the associated Device Profile Form:

    • devVendorInterface (Device Vendor)
    • devFamilyInterface (Device Family)
  • IP Address Closed [click here for a list of attribute values]

    Unique Keys from the IP Address Form: Capabilities Tab:

    • capability (Unique Key of the Capability)
  • Node Closed [click here for a list of attribute values]

    Use the following syntax to specify a Custom Attribute for a Node:

    valueOfNodeCa(<CA_Name>)

    For example: ${valueOfNodeCa(Location)} = USA

    Values from the Basics Attributes on the Node Form:

    • hostname (Hostname, case-sensitive)
    • mgmtIPAddress (Management Address)
    • isSnmpNode (SNMP Agent Enabled)
    • isNnmSystemLocal (NNMi Management Server)

    Values from the Node Form: General Tab:

    • sysName (System Name)
    • sysContact (System Contact)
    • sysLocation (System Location)
    • sysOidNode (System Object ID)

    Addresses from the Node Form: IP Addresses Tab:

    • hostedIPAddress (Address)

      Because NNMi uses a lexicographical compare when evaluating IP addresses, it is recommended that you use the like and not like operators to specify IP address ranges rather than using the following operators: >, >=, <, or <= .

    Unique Keys from the Node Form: Capabilities Tab:

    • capability (Unique Key of the Capability)

    Values from the Basics Attributes on the associated Device Profile Form:

    • devVendorNode (Device Vendor)
    • devFamillyNode (Device Family)

    Values from the associated entry on the Regional Manager Form: Connection Tab:

    • nnmSystemName (Hostname, case-sensitive)

      (NNMi Advanced) If the Global Network Management feature is enabled, this attribute value identifies a Regional Manager (NNMi management server). See Global Manager: Connect to a Regional Manager.

Valid Operators
Operator Description
=

Finds all values equal to the value specified.

ClosedClick here for an example.

Correlate the incidents Configure a Child Incident Filter for a Correlation Rule if the hostedOn value for the Source Object of the Child Incident is equal to the hostedOn value for the Source Object in the Parent Incident.

${child.hostedOn} = ${parent.hostedOn}

!=

Finds all values not equal to the value specified.

ClosedClick here for an example.

Correlate the incidents if the hostedOn value for the Source Object of the Child Incident is not equal to the hostedOn value for the Source Object in the Parent Incident.

${child.hostedOn} != ${parent.hostedOn}

< Finds all values less than the value specified.
<= Finds all values less than or equal to the value specified.
> Finds all values greater than the value specified.
>= Finds all values greater than or equal to the value specified.
is not null Finds all non-blank values.
is null Finds all blank values.
like

Finds matches using the syntax defined for Java regular expressions. See the Pattern (Java Platform SE6) API documentation at:
http://download.oracle.com/javase/6/docs/api/java/util/regex/Pattern.html for more information.

Note To include literal string values in the Value attribute, enclose the string value in \Q<literal_value>\E . 

The period asterisk (.*) characters mean any number of characters of any type at this location.

The period (.) character means any single character of any type at this location.
not like

Finds all matches that do not have the values specified using the syntax defined for Java regular expressions. See the Pattern (Java Platform SE6) API documentation at:
http://download.oracle.com/javase/6/docs/api/java/util/regex/Pattern.html for more information.

Note To include literal string values in the Value attribute, enclose the string value in \Q<literal_value>\E . 

The period asterisk (.*) characters mean any number of characters of any type at this location.

The period (.) character means any single character of any type at this location.

Valid Expressions
Attribute Description
Expression

The value or pattern for which you want NNMi to search.

Note the following:

  • The expression can include a valid Attribute.

  • The value or pattern you want to match is case sensitive.

  • When entering the value for ifSpeed, use the actual numeric value for the interface speed. For example, use 10000000 for ifSpeed 10 Mbps.

Send Help Center feedback