Administer > Configure Incidents > Manage Incidents Using Incident Configurations > Manage the Number of Incoming Incidents > Establish Criteria or Relationships for Incoming Incidents > Configure a Source Object Filter for a Causal Rule

Configure a Source Object Filter for a Causal Rule

The Source Filter tab enables you to create a filter to specify which Source Object should be used for the Parent Incident that is generated for this Causal Rule.

Note Create only one Source Object Filter for a Causal Rule. If you select Use Child Incident's Source Object for Parent, NNMi ignores any Source Object Filter you configure.

For information about each Causal Rules tab: Concept Link IconSee Also

For information about each Child Incident tab: Concept Link IconSee Also

Use the Filter Editor Buttons to insert Boolean Operators and to append, insert, and replace expressions in the Filter String. Use the Drag and Drop feature to make changes to the placement of the expressions in your Filter String. ClosedClick here for more information about using the Filter Editor for Custom Correlations:
  • You can use Custom Incident Attributes, attributes for an incident's Source Node or Source Object, or both to define how matching incidents should be considered for the Correlation Rule. See Valid Attributes  for more information.
  • When specifying Attribute names and values, NNMi uses the type to determine a match. For example, if the Attribute type is numeric, NNMi does a numeric comparison. If the Attribute type is textual, NNMi does a lexographical string comparison. In all cases, when you use the like or not like operator, NNMi uses a lexographical string comparison. Closed Click here for more information about Attribute types:
    • ifIndex and ifSpeed are numeric Attributes.
    • Any Attribute name that begins wtih "is" (isSnmpInterface, isSnmpNode, isNnmSystemLocal) represents a Boolean Attribute.
    • All other Attributes are textual.
  • Each set of expressions associated with a Boolean Operator (for example, AND) is treated as if it were enclosed in parentheses and evaluated together.
  • View the expression displayed under Filter String to see the logic of the expression as it is created.

  • The AND and OR Boolean Operators must contain at least two expressions.

  • The placement of your cursor and the subsequent text that is selected is important when performing operations using the Additional Filters Editor. For example, you append to or replace, the expression that is selected.
  • The placement of your cursor and the subsequent text that is selected is especially important when adding your Boolean operators. See Add Boolean Operators in the Additional Filters Editor for more information.

 

Filter Editor Buttons and Drag and Drop Feature
Button or Feature Description
Append Appends the current expression (Attribute, Operator, and Value) to the selected expression already included in the filter string.
Insert Inserts the current expression (Attribute, Operator, and Value) in front of the cursor location within the Filter String.
Replace Replaces the selected expression with the expression displayed Left or Right Expression.
AND

Inserts the AND Boolean Operator in the selected cursor location.

Note View the expression displayed under Filter String to see the logic of the expression as it is created.
OR

Inserts the OR Boolean Operator in the current cursor location.

Note View the expression displayed under Filter String to see the logic of the expression as it is created.
Delete

Deletes the selected expression.

Note If the Boolean Operator is selected, the Filter Editor deletes all expressions associated with the Boolean Operator.
Drag and Drop

You can drag any of the following items to a new location in the Filter String:

  • Filter Editor Options: AND, OR, NOT, EXISTS, NOT EXISTS
  • Filter Expression (Attribute, Operator, and Value)

When moving items in the Filter String, note the following:

  • Click the item you want to move before dragging it to a new location.
  • As you drag a selected item, an underline indicates the target location.
  • If you are moving the selection up, NNMi places the item above the target location.
  • If you are moving the selection down, NNMi places the item below the target location.
  • If you attempt to move the selection to an invalid target location, NNMi displays an error message.

To configure a Source Object Filter for a Causal Rule:

  1. ClosedNavigate to the Custom Correlation Configuration form:
    1. From the workspace navigation pane, select the  Configuration workspace.
    2. Expand the Incidents folder.
    3. Select Custom Correlation Configuration.
  2. Navigate to the Causal Rules tab.

  3. From the Causal Rules table toolbar, do one of the following:

    • To create a Causal Rule, click the New icon, and continue.
    • To edit a Causal Rule, click the Open icon in the row representing the Causal Rule you want to edit, and continue.
    • To delete a Causal Rule, click the  Delete icon.
  4. Create your Causal Rule. (See Configure a Causal Rule.)
  5. Create your Child Incident Configuration . (See Configure a Child Incident for a Causal Rule.)
  6. Optional. Configure a Child Incident Filter. (See Configure a Child Incident Filter for a Causal Rule.)

  7. Optional. Configure a Source Object Filter. (See the tables that follow, starting with Filter Editor Settings).

    Filter Editor Settings
    Setting Description
    Attribute

    The Attribute on which NNMi searches. See Valid Attributes below for a description of valid Attributes.

    Operator Use this Operator to establish the relationship between the Attribute and Expression. See Valid Operators in the table below for the description of each valid Operator.
    Expression Use the Expression to complete the criteria for the Parent Incident configuration. See Valid Expressions below for more information.
  8. Optional. Configure a Source Node Filter. (See Configure a Source Node Filter for a Causal Rule.)
  9. Click  Save and Close to save your changes and return to the previous form.

Valid Attributes
Attribute Description
Attribute

The Attribute on which NNMi searches. Valid attributes other than Source Node attributes depend on the Incident's Source Object. NNMi checks the Source Node as well as the Source Object for any Capability value.

Note the following when specifying Attributes:

  • Boolean Attributes begin with "is" and must contain the value true or false.
  • If you use attributes that are valid for the Source Node, NNMi uses the Source Node when comparing values. If you use attributes that are valid for the Source Object, NNMi uses the Source Object when comparing values. You cannot use attributes that are valid for the Source Node and Source Object in the same filter.

  • When using attributes for a Source Object, the attribute must be valid for the incident's Source Object or NNMi does not find a match. For example, if you use the hostedOn attribute and the Source Object is not an interface, the correlation does not occur.

  • Tip To check a Source Object for an incident, select the incident of interest, then select Open from the Lookup menu for the Source Object, and examine the Source Object form.

    A Source Object attribute value of None indicates that NNMi cannot identify the Source Object or the Source Object is a Node. If you want to match the incident, use one or more Source Node attributes.

  • Interface Closed[click here for a list of attribute values]

    Use the following syntax to specify a Custom Attribute for an Interface:

    valueOfInterfaceCa(<CA_Name>)

    For example: ${child.valueOfInterfaceCA(Role)} =  WAN Connection

    Values from the Basics Attributes listed on the Interface Form:

    • hostedOn (Hosted On Node)

      Note You must use the full DNS name for the hostedOn value.

    Values from the Interface Form: General Tab:

    • ifName (name configured for the interface)
    • ifAlias (alias configured for the interface)
    • ifDesc (description configured for the interface)
    • ifIndex (index assigned to the interface)

    • ifSpeed (speed configured for the interface)

      Note When entering the value for ifSpeed, use the actual numeric value for the interface speed. For example, use 10000000 for ifSpeed 10 Mbps.

    Addresses from the Interface Form: IP Addresses Tab:

    • ipAddress (IP Address associated with the interface)

      Because NNMi uses a lexicographical compare when evaluating IP addresses, it is recommended that you use the like and not like operators to specify IP address ranges rather than using the following operators: >, >=, <, or <= .

    Unique Keys from the Interface Form: Capabilities Tab:

    • capability (Unique Key of the Capability)

    Values from the Basics Attributes on the parent Node Form:

    • isSnmpInterface (SNMP Agent Enabled)

    Values from the parent Node Form: General Tab:

    • sysOidInterface (System Object ID)

    Values from the Basics Attributes on the associated Device Profile Form:

    • devVendorInterface (Device Vendor)
    • devFamilyInterface (Device Family)
  • IP Address Closed [click here for a list of attribute values]

    Unique Keys from the IP Address Form: Capabilities Tab:

    • capability (Unique Key of the Capability)
  • Node Closed [click here for a list of attribute values]

    Use the following syntax to specify a Custom Attribute (CA) for a Node:

    valueOfNodeCa(<CA_Name>)

    For example: ${valueOfNodeCa(Location)} = USA

    Values from the Basics Attributes on the Node Form:

    • hostname (Hostname, case-sensitive)
    • mgmtIPAddress (Management Address)
    • isSnmpNode (SNMP Agent Enabled)
    • isNnmSystemLocal (NNMi Management Server)

    Values from the Node Form: General Tab:

    • sysName (System Name)
    • sysContact (System Contact)
    • sysLocation (System Location)
    • sysOidNode (System Object ID)

    Addresses from the Node Form: IP Addresses Tab:

    • hostedIPAddress (Address)

      Because NNMi uses a lexicographical compare when evaluating IP addresses, it is recommended that you use the like and not like operators to specify IP address ranges rather than using the following operators: >, >=, <, or <= .

    Unique Keys from the Node Form: Capabilities Tab:

    • capability (Unique Key of the Capability)

    Values from the Basics Attributes on the associated Device Profile Form:

    • devVendorNode (Device Vendor)
    • devFamillyNode (Device Family)

    Values from the associated entry on the Regional Manager Form: Connection Tab:

    • nnmSystemName (Hostname, case-sensitive)

      (NNMi Advanced) If the Global Network Management feature is enabled, this attribute value identifies a Regional Manager (NNMi management server).

Valid Operator Values
Operator Description
=

Finds all values equal to the value specified.

ClosedClick here for examples.

Match any incident with a CIA value of 5 and Object Identifier (OID) of .1.3.6.1.4.1.9.9.106.2.0.1:

${valueOfCia(\Q.1.3.6.1.4.1.9.9.106.2.0.1\E)} = 5

!=

Finds all values not equal to the value specified.

ClosedClick here for an example.

Match any incident with a Source Object value of Interface with Device Vendor value not equal to Cisco:

${devVendorInterface} != Cisco

<

Finds all values less than the value specified.

ClosedClick here for an example.

Match any incident with a CIA value less than 5 and Object Identifier (OID) value of .1.3.6.1.4.1.9.9.106.2.0.1:

${valueOfCia(\Q.1.3.6.1.4.1.9.9.106.2.0.1\E)} < 5

<=

Finds all values less than or equal to the value specified.

ClosedClick here for examples.

Match any incident with a CIA attribute value less than or equal to 5 and Object Identifier (OID) value of .1.3.6.1.4.1.9.9.106.2.0.1:

${valueOfCia (\Q.1.3.6.1.4.1.9.9.106.2.0.1\E)} <= 5

>

Finds all values greater than the value specified.

ClosedClick here for an example.

Match any incident with a CIA value greater than 5 and Object Identifier (OID) attribute value of .1.3.6.1.4.1.9.9.106.2.0.1:

${valueOfCia (\Q.1.3.6.1.4.1.9.9.106.2.0.1\E)} > 5
>=

Finds all values greater than or equal to the value specified.

ClosedClick here for an example.

Match any incident with a Source Object attribute value of Interface that has an (interface speed) ifSpeed of 10Mbps:

${ifSpeed} >= 10000000

is not null

Finds all non-blank values.

ClosedClick here for an example.

Match any incident with a Source Object attribute value of Interface that has an (interface name) ifName value:

${ifName} is not null

is null

Finds all blank values.

ClosedClick here for an example.

Match any incident with a Source Object attribute value of Interface that does not have an (interface name) ifName value:

${ifName} is null

like

Finds matches using wildcard characters and the question mark.

The asterisk (*) character means any number of characters of any type at this location.

The question mark (?) character means any single character of any type at this location.

ClosedClick here for an example.

Match any incident with a Source Object attribute value of Interface with a (description) ifDesc that begins with Serial followed by any number of characters:

${ifDesc} like Serial*

Match any incident with a Source Object attribute value of Interface with an (interface alias) ifAlias value that begins with EtherChannel (for example, EtherChannel Group 1).

${ifAlias} like EtherChannel*

not like

Finds all matches that do not have the values specified.

The asterisk (*) characters means any number of characters of any type at this location.

The question mark (?) character means any single character of any type at this location.

ClosedClick here for an example.

Match any with a Source Object attribute value of Interface with an (interface name) ifName value that does not begin with rtr*:

${ifName} not like rtr*

Valid Expressions
Attribute Description
Expression

The value or pattern for which you want NNMi to search.

Note the following:

  • The expression can include a valid Attribute.

  • The value or pattern you want to match is case sensitive.

  • When entering the value for ifSpeed, use the actual numeric value for the interface speed. For example, use 10000000 for ifSpeed 10 Mbps.

Send Help Center feedback