Administer > Configure Incidents > Manage Incidents Using Incident Configurations > Manage the Number of Incoming Incidents > Establish Criteria or Relationships for Incoming Incidents > Configure a Child Incident Filter for a Correlation Rule

Configure a Child Incident Filter for a Correlation Rule

Note See Help → Documentation Library → Release Notes, and locate the Support Matrix link for Child Incident Filter limitations.

Tip The Child Incident Filter is optional, but recommended. Use of a Child Incident Filter improves NNMi performance by reducing the set of incidents that NNMi processes.

When correlating groups of incidents under a Parent incident, you must specify the requirements for the Child Incident. The Child Incident tab enables you to use the Filter Editor to define these requirements. For example, you might want to specify that the Source Node of the Child Incident be a specific Node Name pattern. See Valid Operators in the table that follows for examples of valid Child Incident Filters.

Use the Filter Editor Buttons to insert Boolean Operators and to append, insert, and replace expressions in the Filter String. Use the Drag and Drop feature to make changes to the placement of the expressions in your Filter String. ClosedClick here for more information about using the Filter Editor for Custom Correlations:
  • You can use Custom Incident Attributes, attributes for an incident's Source Node or Source Object, or both to define how matching incidents should be considered for the Correlation Rule. See Valid Attributes  for more information.
  • When specifying Attribute names and values, NNMi uses the type to determine a match. For example, if the Attribute type is numeric, NNMi does a numeric comparison. If the Attribute type is textual, NNMi does a lexographical string comparison. In all cases, when you use the like or not like operator, NNMi uses a lexographical string comparison. Closed Click here for more information about Attribute types:
    • ifIndex and ifSpeed are numeric Attributes.
    • Any Attribute name that begins with "is" (isSnmpInterface, isSnmpNode, isNnmSystemLocal) represents a Boolean Attribute.
    • All other Attributes are textual.
  • Each set of expressions associated with a Boolean Operator (for example, AND) is treated as if it were enclosed in parentheses and evaluated together.
  • View the expression displayed under Filter String to see the logic of the expression as it is created.

  • The AND and OR Boolean Operators must contain at least two expressions.

  • The placement of your cursor and the subsequent text that is selected is important when performing operations using the Additional Filters Editor. For example, you append to or replace, the expression that is selected.
  • The placement of your cursor and the subsequent text that is selected is especially important when adding your Boolean operators. See Add Boolean Operators in the Additional Filters Editor for more information.

 

    Filter Editor Buttons and Drag and Drop Feature
    Button or Feature Description
    Append Appends the current expression (Attribute, Operator, and Value) to the selected expression already included in the filter string.
    Insert Inserts the current expression (Attribute, Operator, and Value) in front of the cursor location within the Filter String.
    Replace Replaces the selected expression with the expression displayed Left or Right Expression.
    AND

    Inserts the AND Boolean Operator in the selected cursor location.

    Note View the expression displayed under Filter String to see the logic of the expression as it is created.
    OR

    Inserts the OR Boolean Operator in the current cursor location.

    Note View the expression displayed under Filter String to see the logic of the expression as it is created.
    Delete

    Deletes the selected expression.

    Note If the Boolean Operator is selected, the Filter Editor deletes all expressions associated with the Boolean Operator.
    Drag and Drop

    You can drag any of the following items to a new location in the Filter String:

    • Filter Editor Options: AND, OR, NOT, EXISTS, NOT EXISTS
    • Filter Expression (Attribute, Operator, and Value)

    When moving items in the Filter String, note the following:

    • Click the item you want to move before dragging it to a new location.
    • As you drag a selected item, an underline indicates the target location.
    • If you are moving the selection up, NNMi places the item above the target location.
    • If you are moving the selection down, NNMi places the item below the target location.
    • If you attempt to move the selection to an invalid target location, NNMi displays an error message.

See Correlation Rule Example for a step-by-step example of how the Subinterface Correlation Rule provided by NNMi was created.

To configure a Child Incident Filter:

  1. ClosedNavigate to the Custom Correlation Configuration form:
    1. From the workspace navigation pane, select the  Configuration workspace.
    2. Expand the Incidents folder.
    3. Select Custom Correlation Configuration.
  2. Navigate to the Correlation Rules tab.
  3. From the Correlation Rules table toolbar, do one of the following:
    • To create a Correlation Rule, click the New icon, and continue.
    • To edit a Correlation Rule, click the Open icon in the row representing the Correlation Rule you want to edit, and continue.
    • To delete a Correlation Rule, click the  Delete icon.
  4. Navigate to the Child Incident Filter tab.

  5. Create your Child Incident Filter (see the Filter Editor Settings below).

    Filter Editor Settings
    Setting Description
    Attribute

    The Attribute on which NNMi searches. See Valid Attributes below for a description of valid Attributes.

    Operator

    Use this Operator to establish the relationship between the Attribute and Expression. See Valid Operators in the table below for the description of each valid Operator.

    Note When specifying the like or not like operator, you must use the syntax defined for Java regular expressions. For more information, see the Pattern (Java Platform SE6) API documentation at:
    http://download.oracle.com/javase/6/docs/api/java/util/regex/Pattern.html
    Expression

    Use the Expression to complete the criteria for the Child Incident configurations. See Valid Expressions below for more information.

  6. Click  Save and Close to save your changes and return to the previous form.

Valid Attributes
Attribute Description
Attribute

The Attribute on which NNMi searches. Valid attributes other than Source Node attributes depend on the Incident's Source Object. NNMi checks the Source Node as well as the Source Object for any Capability value.

Note the following when specifying Attributes:

  • Boolean Attributes begin with "is" and must contain the value true or false.

  • Use the following syntax to specify a Custom Incident Attribute (CIA):

    valueOfCia(<CIA_Name>)

    • Check the appropriate Incident form for any valid CIA Names provided by NNMi.

      For example: ${valueOfCia(\Q.1.3.6.1.4.1.9.9.106.2.0.1\E)}= 5

    • When specifying the <CIA_Name>, you can use the syntax defined for Java regular expressions. For example, use the following syntax to specify that you want to include any CIA Name that begins with .1.3.6.1.2.1.31.1.1.1.1.: ${valueOfCia(\Q.1.3.6.1.2.1.31.1.1.1.1.\E.*)}

    • Enclose all CIA names using the \Q and \E characters so that NNMi correctly interprets the period character. For example: ${child.valueOfCia(\Qcia.address\E)}

      For more information, see the Pattern (Java Platform SE6) API documentation at:
      http://download.oracle.com/javase/6/docs/api/java/util/regex/Pattern.html

  • If you use attributes that are valid for the Source Node, NNMi uses the Source Node when comparing values. If you use attributes that are valid for the Source Object, NNMi uses the Source Object when comparing values. You cannot use attributes that are valid for the Source Node and Source Object in the same filter.

  • When using attributes for a Source Object, note the following:

    • When using attributes for a Source Object, the attribute must be valid for the incident's Source Object or NNMi does not find a match. For example, if you use the hostedOn attribute and the Source Object is not an interface, the correlation does not occur.

      Tip To check a Source Object for an incident, select the incident of interest, then select Open from the Lookup menu for the Source Object, and examine the Source Object form.

    • SNMP Trap incidents only. NNMi does not find a match when the value for a Source Object is None. A Source Object attribute value of None indicates that NNMi cannot resolve the Source Object. If you want to match the incident, use one or more Source Node attributes.

  • If the incident does not have a Source Object, a Source Node, or both (for example, the node is not stored in the NNMi database), you must use CIAs in your filter rather than Source Object or Source Node attributes.

    Tip To check whether the Source Object or Source Node is stored in the NNMi database, open the incident and then select Open from the Lookup menu for the Source Node or Source Object displayed. If a form does not open for the selected object or node, this means the source is not stored in the NNMi database.

  • When specifying a Correlation Filter, precede the attribute name with either parent. or child. to specify from which incident the attribute value should be compared. For example, you might specify ${parent.hostedOn} or ${child.ifDesc}.

Possible Source Object choices are as follows:

  • Card Closed [click here for a list of attribute values]

    Unique Keys from the Card Form: Capabilities Tab:

    • capability (Unique Key of the Capability)
  • Interface Closed[click here for a list of attribute values]

    Use the following syntax to specify a Custom Attribute for an Interface:

    valueOfInterfaceCa(<CA_Name>)

    For example: ${child.valueOfInterfaceCA(Role)} =  WAN Connection

    Values from the Basics Attributes listed on the Interface Form:

    • hostedOn (Hosted On Node)

      You must use the full DNS name for the hostedOn value.

    Values from the Interface Form: General Tab:

    • ifName (name configured for the interface)
    • ifAlias (alias configured for the interface)
    • ifDesc (description configured for the interface)
    • ifIndex (index assigned to the interface)

    • ifSpeed (speed configured for the interface)

      When entering the value for ifSpeed, use the actual numeric value for the interface speed. For example, use 10000000 for ifSpeed 10 Mbps.

    Addresses from the Interface Form: IP Addresses Tab:

    • ipAddress (IP Address associated with the interface)

      Because NNMi uses a lexicographical compare when evaluating IP addresses, it is recommended that you use the like and not like operators to specify IP address ranges rather than using the following operators: >, >=, <, or <=.

    Unique Keys from the Interface Form: Capabilities Tab:

    • capability (Unique Key of the Capability)

    Values from the Basics Attributes on the parent Node Form:

    • isSnmpInterface (SNMP Agent Enabled)

    Values from the parent Node Form: General Tab:

    • sysOidInterface (System Object ID)

    Values from the Basics Attributes on the associated Device Profile Form:

    • devVendorInterface (Device Vendor)
    • devFamilyInterface (Device Family)
  • IP Address Closed [click here for a list of attribute values]

    Unique Keys from the IP Address Form: Capabilities Tab:

    • capability (Unique Key of the Capability)
  • Node Closed [click here for a list of attribute values]

    Use the following syntax to specify a Custom Attribute for a Node:

    valueOfNodeCa(<CA_Name>)

    For example: ${valueOfNodeCa(Location)} = USA

    Values from the Basics Attributes on the Node Form:

    • hostname (Hostname, case-sensitive)
    • mgmtIPAddress (Management Address)
    • isSnmpNode (SNMP Agent Enabled)
    • isNnmSystemLocal (NNMi Management Server)

    Values from the Node Form: General Tab:

    • sysName (System Name)
    • sysContact (System Contact)
    • sysLocation (System Location)
    • sysOidNode (System Object ID)

    Addresses from the Node Form: IP Addresses Tab:

    • hostedIPAddress (Address)

      Because NNMi uses a lexicographical compare when evaluating IP addresses, it is recommended that you use the like and not like operators to specify IP address ranges rather than using the following operators: >, >=, <, or <= .

    Unique Keys from the Node Form: Capabilities Tab:

    • capability (Unique Key of the Capability)

    Values from the Basics Attributes on the associated Device Profile Form:

    • devVendorNode (Device Vendor)
    • devFamillyNode (Device Family)

    Values from the associated entry on the Regional Manager Form: Connection Tab:

    • nnmSystemName (Hostname, case-sensitive)

      (NNMi Advanced) If the Global Network Management feature is enabled, this attribute value identifies a Regional Manager (NNMi management server). See Global Manager: Connect to a Regional Manager.

Valid Operator Values
Operator Description
=

Finds all values equal to the value specified.

ClosedClick here for examples.

Match any incident with a CIA value of 5 and Object Identifier (OID) of .1.3.6.1.4.1.9.9.106.2.0.1:

${valueOfCia(\Q.1.3.6.1.4.1.9.9.106.2.0.1\E)} = 5

Match any incident with the Source Object's Capability equal to com.hp.nnm.capability.card.fru

$(capability) =  com.hp.nnm.capability.card.fru
!=

Finds all values not equal to the value specified.

ClosedClick here for an example.

Match any incident with Device Vendor for the interface (Source Object) not equal to Cisco:

${devVendorInterface} != Cisco
<

Finds all values less than the value specified.

ClosedClick here for an example.

Match any incident with a CIA value of less than 5 and Object Identifier (OID) of .1.3.6.1.4.1.9.9.106.2.0.1:

${valueOfCia(\Q.1.3.6.1.4.1.9.9.106.2.0.1\E)} < 5
<=

Finds all values less than or equal to the value specified.

ClosedClick here for examples.

Match any incident with a CIA value of less than or equal to 5 and Object Identifier (OID) of .1.3.6.1.4.1.9.9.106.2.0.1:

${valueOfCia (\Q.1.3.6.1.4.1.9.9.106.2.0.1\E)} <= 5
>

Finds all values greater than the value specified.

ClosedClick here for an example.

Match any incident with a CIA value of greater than 5 and Object Identifier (OID) of .1.3.6.1.4.1.9.9.106.2.0.1:

${valueOfCia (\Q.1.3.6.1.4.1.9.9.106.2.0.1\E)} > 5
>=

Finds all values greater than or equal to the value specified.

ClosedClick here for an example.

Match any incident with a Source Object's (interface speed) ifSpeed value of 10Mbps:

${ifSpeed} >= 10000000
is not null

Finds all non-blank values.

ClosedClick here for an example.

Match any incident with a Source Object's (interface name) ifName attribute that contains a value:

${ifName} is not null
is null

Finds all blank values.

ClosedClick here for an example.

Match any incident with a Source Object's (interface name) ifName attribute that does not contain a value:

${ifName} is null
like

Finds matches using the syntax defined for Java regular expressions. For more information, see the Pattern (Java Platform SE6) API documentation at:
http://download.oracle.com/javase/6/docs/api/java/util/regex/Pattern.html

Note To include literal string values in the Value attribute, enclose the string value in \Q<literal_value>\E . 

The period asterisk (.*) characters mean any number of characters of any type at this location.

The period (.) character means any single character of any type at this location.

ClosedClick here for an example.

Match any incident with a Source Object's (interface description) ifDesc attribute that includes Serial followed by one or more digits:

${ifDesc} like Serial\d+

Match any incident with a Source Object's (interface alias) ifAlias attribute that contains EtherChannel (for example, PAgPEtherChannel Group 1).

Note The . (period) indicates any alphanumeric character.

${ifAlias} like .*EtherChannel.*

Match any incident with a CIA attribute value of Chassis Fan Tray followed by a digit and Object Identifier (OID) of .1.3.6.1.4.1.9.9.13.1.4.1.3

Note To include literal strings in the value, enclose the string value in \Q<literal_value>\E as shown in the following example.

${valueOfCia(\Q.1.3.6.1.4.1.9.9.13.1.4.1.3\E)} like Chassis Fan Tray \d
not like

Finds all matches that do not have the values specified using the syntax defined for Java regular expressions. For more information, see the Pattern (Java Platform SE6) API documentation at:
http://download.oracle.com/javase/6/docs/api/java/util/regex/Pattern.html

Note To include literal string values in the Value attribute, enclose the string value in \Q<literal_value>\E . 

The period asterisk (.*) characters mean any number of characters of any type at this location.

The period (.) character means any single character of any type at this location.

ClosedClick here for an example.

Match any incident with a Source Object's (interface name) ifName value that does not include rtr:

${ifName} not like .*rtr.*

Valid Expressions
Attribute Description
Expression

The value or pattern for which you want NNMi to search.

Note the following:

  • The expression can include a valid Attribute.

  • The value or pattern you want to match is case sensitive.

  • When entering the value for ifSpeed, use the actual numeric value for the interface speed. For example, use 10000000 for ifSpeed 10 Mbps.

Send Help Center feedback