Configure a Child Incident Filter for a Causal Rule

Note See HelpDocumentation LibraryRelease Notes, and locate the Support Matrix link for Child Incident Filter limitations.

The Child Incident Filter tab enables you to create a filter to specify which Child Incidents should be considered for correlation according to the Causal Rule you are configuring.

For information about each Causal Rules tabConcept Link IconSee Also 

For information about each Child Incident tabConcept Link IconSee Also

To configure a Child Incident Filter for a Causal Rule:

  1. Navigate to the Causal Rules tab.
  2. From the Causal Rules table toolbar, do one of the following:
    • To create a Causal Rule, click the New icon, and continue.
    • To edit a Causal Rule, click the Open icon in the row representing the Causal Rule you want to edit, and continue.
    • To delete a Causal Rule, click the  Delete icon.
  3. Create your Causal Rule. (See Configure a Causal Rule.)
  4. Create your Child Incident Configuration . (See Configure a Child Incident for a Causal Rule.)
  5. Optional. Configure a Child Incident Filter. (See Filter Editor Settings).

    Filter Editor Settings
    Setting Description
    Attribute

    The Attribute on which NNMi searches. See Valid Attributes below for a description of valid Attributes.

    Operator Use this Operator to establish the relationship between the Attribute and Expression. See Valid Operators in the table below for the description of each valid Operator.
    Expression Use the Expression to complete the criteria for the Parent Incident configuration. See Valid Expressions below for more information.
  6. Optional. Configure a Source Object Filter. (See Configure a Source Object Filter for a Causal Rule.)
  7. Optional. Configure a Source Node Filter. (See Configure a Source Node Filter for a Causal Rule.)
  8. Click  Save and Close to save your changes and return to the previous form.

Valid Attributes
Attribute Description
Attribute

The Attribute on which NNMi searches. Valid attributes other than Source Node attributes depend on the Incident's Source Object. NNMi checks the Source Node as well as the Source Object for any Capability value.

Note the following when specifying Attributes:

  • Boolean Attributes begin with "is" and must contain the value true or false.
  • Use the following syntax to specify a Custom Incident Attribute (CIA):

    valueOfCia(<CIA_Name>)

    • Check the appropriate Incident form for any valid CIA Names provided by NNMi.

      For example: ${valueOfCia(\Q.1.3.6.1.4.1.9.9.106.2.0.1\E)}= 5

    • When specifying the <CIA_Name>, you can use the syntax defined for Java regular expressions. For example, use the following syntax to specify that you want to include any CIA Name that begins with .1.3.6.1.2.1.31.1.1.1.1.: ${valueOfCia(\Q.1.3.6.1.2.1.31.1.1.1.1.\E.*)}
    • Enclose all CIA names using the \Q and \E characters so that NNMi correctly interprets the period character. For example: ${child.valueOfCia(\Qcia.address\E)}

      For more information, see the Pattern (Java Platform SE6) API documentation at:
      http://download.oracle.com/javase/6/docs/api/java/util/regex/Pattern.html

  • If you use attributes that are valid for the Source Node, NNMi uses the Source Node when comparing values. If you use attributes that are valid for the Source Object, NNMi uses the Source Object when comparing values. You cannot use attributes that are valid for the Source Node and Source Object in the same filter.
  • When using attributes for a Source Object, note the following:

    • When using attributes for a Source Object, the attribute must be valid for the incident's Source Object or NNMi does not find a match. For example, if you use the hostedOn attribute and the Source Object is not an interface, the correlation does not occur.

      Tip To check a Source Object for an incident, select the incident of interest, then select Open from the Lookup menu for the Source Object, and examine the Source Object form.

    • SNMP Trap incidents only. NNMi does not find a match when the value for a Source Object is None. A Source Object attribute value of None indicates that NNMi cannot resolve the Source Object. If you want to match the incident, use one or more Source Node attributes.

  • If the incident does not have a Source Object, a Source Node, or both (for example, the node is not stored in the NNMi database), you must use CIAs in your filter rather than Source Object or Source Node attributes.

    Tip To check whether the Source Object or Source Node is stored in the NNMi database, open the incident and then select Open from the Lookup menu for the Source Node or Source Object displayed. If a form does not open for the selected object or node, this means the source is not stored in the NNMi database.

  • When specifying a Correlation Filter, precede the attribute name with either parent. or child. to specify from which incident the attribute value should be compared. For example, you might specify ${parent.hostedOn} or ${child.ifDesc}.

Possible Source Object choices are as follows:

Valid Operator Values
Operator Description
=

Finds all values equal to the value specified.

!=

Finds all values not equal to the value specified.

<

Finds all values less than the value specified.

<=

Finds all values less than or equal to the value specified.

>

Finds all values greater than the value specified.

>=

Finds all values greater than or equal to the value specified.

is not null

Finds all non-blank values.

is null

Finds all blank values.

like

Finds matches using the syntax defined for Java regular expressions. For more information, see the Pattern (Java Platform SE6) API documentation at:
http://download.oracle.com/javase/6/docs/api/java/util/regex/Pattern.html

Note To include literal string values in the Value attribute, enclose the string value in \Q<literal_value>\E . 

The period asterisk (.*) characters mean any number of characters of any type at this location.

The period (.) character means any single character of any type at this location.

not like

Finds all matches that do not have the values specified using the syntax defined for Java regular expressions. For more information, see the Pattern (Java Platform SE6) API documentation at:
http://download.oracle.com/javase/6/docs/api/java/util/regex/Pattern.html

Note To include literal string values in the Value attribute, enclose the string value in \Q<literal_value>\E . 

The period asterisk (.*) characters mean any number of characters of any type at this location.

The period (.) character means any single character of any type at this location.

Valid Expressions
Attribute Description
Expression

The value or pattern for which you want NNMi to search.

Note the following:

  • The expression can include a valid Attribute.

  • The value or pattern you want to match is case sensitive.

  • When entering the value for ifSpeed, use the actual numeric value for the interface speed. For example, use 10000000 for ifSpeed 10 Mbps.