Administer > Configure Incidents > Manage Incidents Using Incident Configurations > Manage the Number of Incoming Incidents > Establish Criteria or Relationships for Incoming Incidents > Configure a Causal Rule

Configure a Causal Rule

Tip Configure a Causal Rule when you want to cause NNMi to generate a Parent Incident and you want to correlate one or more Child Incident Configurations under the Parent Incident that you cause to be generated.

Note See Help → Documentation Library → Release Notes, and locate the Support Matrix link for Causal Rule limitations.

When correlating groups of incidents under a Parent incident, use the Causal Rules tab to specify the following.

  • Parent Incident Configuration to be generated
  • One or more Child Incident Configurations to be correlated with the generated Parent Incident
  • Filters that NNMi should use when selecting the Child Incident instances for correlation
  • Source Object and Source Node Filter to be used to determine the Source Node and Source Object for the Parent Incident that is generated
  • The time window that must be met before NNMi correlates the incidents

For information about each Causal Rules tab: Concept Link IconSee Also

To configure a Causal Rule:

  1. ClosedNavigate to the Custom Correlation Configuration form:
    1. From the workspace navigation pane, select the  Configuration workspace.
    2. Expand the Incidents folder.
    3. Select Custom Correlation Configuration.
  2. Navigate to the Causal Rules tab.

  3. From the Causal Rules table toolbar, do one of the following:

    • To create a Causal Rule, click the New icon, and continue.
    • To edit a Causal Rule, click the Open icon in the row representing the Causal Rule you want to edit, and continue.
    • To delete a Causal Rule, click the  Delete icon.
  4. Create your Causal Rule (see table).
  5. Click  Save and Close to save your changes and return to the previous form.
Cause Rule Basic Attributes
Attribute Description
Name

Type a maximum of 64 characters. Alpha-numeric, spaces, and special characters (~ ! @ # $ % ^ & * ( ) _+ -) are permitted.

The name is used to identify the Causal Rule and must be unique. Use a name that will help you to remember the purpose of the Causal Rule.
Author

Indicates who created or last modified the Causal Rule.

If the Author attribute value is Network Node Manager, any changes are at risk of being overwritten in the future.

  • Click  Lookup and select  Show Analysis to display details about the currently selected Author.
  • Click  Quick Find to access the list of existing Author values.
  • Click  New to create an Author value.
Enabled

If  enabled, the NNMi Causal Engine uses the Causal Rule when evaluating incidents.

If   disabled, the Causal Rule is ignored.
Parent Incident

Specifies the incident configuration that should be generated as the Parent Incident for the Causal Rule.

To specify a Parent Incident configuration:

  1. Click the Lookup icon, and do one of the following:

    • To display Analysis Pane information, select Show Analysis.
    • To display the list of possible incidents, select Quick Find. In the Quick Find dialog, select the Incident of interest.

    • To create a Parent Incident, select one of the following:

      • New Management Event Configuration
      • New Remote NNM Event Configuration
      • New SNMP Trap Configuration
    • To modify a Parent Incident, select Open.
  2. Optional. To create or modify a Parent Incident, enter or modify the attribute values for the selected Incident configuration. See Configure Incidents for more information about the Incident Configuration form.
  3. Click  Save and Close to save your changes and return to the previous form.
  4. Optional. To create or modify a Parent Incident, enter or modify the attribute values for the selected Incident configuration.
  5. Click  Save and Close to save your changes and return to the previous form.
Correlation Nature

Select the Correlation Nature that you want to assign to the Parent Incident that is generated.

Note The Child Incident will have the Correlation Nature of Secondary Root Cause.
Common Child Incident Attribute

Specifies the Incident Attribute that all Child Incidents must have in common for the incident instance to be correlated under the Parent Incident defined for the Causal Rule. For example, if you want to ensure that all child incidents are from the same node, use the ${hostedOn} attribute.

Valid attributes other than Source Node attributes depend on the Incident's Source Object. NNMi checks the Source Node as well as the Source Object for any attribute value.

Note the following when specifying Attributes:

  • You cannot specify $(capability) as a Common Child Incident Attribute.
  • Boolean Attributes begin with "is" and must contain the value true or false.

  • Use the following syntax to specify a Custom Incident Attribute (CIA):

    valueOfCia(<CIA_Name>)

    Note Check the appropriate Incident form for any valid CIA Names provided by NNMi.

    For example: ${valueOfCia(\Q.1.3.6.1.4.1.9.9.106.2.0.1\E)}

  • When specifying the <CIA_Name>, you can use the syntax defined for Java regular expressions. For example, use the following syntax to specify that you want to include any CIA Name that begins with .1.3.6.1.2.1.31.1.1.1.1.: ${valueOfCia(\Q.1.3.6.1.2.1.31.1.1.1.1.\E.*)}

    Note Enclose all CIA names using the \Q and \E characters so that NNMi correctly interprets the period character. For example: $child.valueOfCia(\Qcia.address\E)}.

    See the Pattern (Java Platform SE6) API documentation at:
    http://download.oracle.com/javase/6/docs/api/java/util/regex/Pattern.html for more information.

  • If you use attributes that are valid for the Source Node, NNMi uses the Source Node when comparing values. If you use attributes that are valid for the Source Object, NNMi uses the Source Object when comparing values. You cannot use attributes that are valid for the Source Node and Source Object in the same filter.

  • When using attributes for a Source Object, the attribute must be valid for the incident's Source Object or NNMi does not find a match. For example, if you use the hostedOn attribute and the Source Object is not an interface, the correlation does not occur.

  • Tip To check a Source Object for an incident, select the incident of interest, then select Open from the Lookup menu for the Source Object, and examine the Source Object form.

    A Source Object attribute value of None indicates that NNMi cannot identify the Source Object or the Source Object is a Node. If you want to match the incident, use one or more Source Node attributes.

  • If the incident does not have a Source Object, a Source Node, or both (for example, the node is not stored in the NNMi database), you must use CIAs rather than Source Object or Source Node attributes.

    Tip To check whether the Source Object or Source Node is stored in the NNMi database, open the incident and then select Open from the Lookup menu for the Source Node or Source Object displayed. If a form does not open for the selected object or node, this means the source is not stored in the NNMi database.

Possible Source Object choices are as follows:

  • Interface Closed[click here for a list of attribute values]

    Use the following syntax to specify a Custom Attribute for an Interface:

    valueOfInterfaceCa(<CA_Name>)

    For example: ${child.valueOfInterfaceCA(Role)}

    Values from the Basics Attributes listed on the Interface Form:

    • hostedOn (Hosted On Node)

    Values from the Interface Form: General Tab:

    • ifName (name configured for the interface)
    • ifAlias (alias configured for the interface)
    • ifDesc (description configured for the interface)
    • ifIndex (index assigned to the interface)
    • ifSpeed (speed configured for the interface)

    Addresses from the Interface Form: IP Addresses Tab:

    • ipAddress (IP Address associated with the interface)

    Values from the Basics Attributes on the parent Node Form:

    • isSnmpInterface (SNMP Agent Enabled)

    Values from the parent Node Form: General Tab:

    • sysOidInterface (System Object ID)

    Values from the Basics Attributes on the associated Device Profile Form:

    • devVendorInterface (Device Vendor)
    • devFamilyInterface (Device Family)
  • Node Closed [click here for a list of attribute values]

    Use the following syntax to specify a Custom Attribute (CA) for a Node:

    valueOfNodeCa(<CA_Name>)

    For example: ${valueOfNodeCa(Location)}

    Values from the Basics Attributes on the Node Form:

    • hostname (Hostname, case-sensitive)
    • mgmtIPAddress (Management Address)
    • isSnmpNode (SNMP Agent Enabled)
    • isNnmSystemLocal (NNMi Management Server)

    Values from the Node Form: General Tab:

    • sysName (System Name)
    • sysContact (System Contact)
    • sysLocation (System Location)
    • sysOidNode (System Object ID)

    Addresses from the Node Form: IP Addresses Tab:

    • hostedIPAddress (Address)

    Values from the Basics Attributes on the associated Device Profile Form:

    • devVendorNode (Device Vendor)
    • devFamillyNode (Device Family)

    Values from the associated entry on the Regional Manager Form: Connection Tab:

    • nnmSystemName (Hostname, case-sensitive)

      (NNMi Advanced) If the Global Network Management feature is enabled, this attribute value identifies a Regional Manager (NNMi management server).

Correlation Window Duration

The time window that must be met before NNMi correlates the incidents. Enter a number for Days, Hours, Minutes, and Seconds.

Note the following:

  • NNMi waits until the Correlation Window Duration has passed before generating the Parent Incident and correlating its Child Incidents.
  • If you are relating multiple Custom Correlations, make sure the Correlation Window Duration allows enough time for all of the Parent and Child incidents to be generated. For example, to correlate two or more Interface Down incidents under a new incident on interfaces that are polled every 5 minutes, use a 6-minute Correlation Window Duration. The 6-minute window ensures that the Interface Down incidents, which might occur 5 minutes apart, will be correlated under the new incident.
Description

Use the description field to provide additional information that you would like to store about the current incident configuration. This description applies only to the configuration entry.

Type a maximum of 2048 characters. Alpha-numeric, spaces, and special characters (~ ! @ # $ % ^ & * ( ) _+ -) are permitted.

Send Help Center feedback