Administer > Configure Incidents > Manage Incidents Using Incident Configurations > Manage the Number of Incoming Incidents > Establish Criteria or Relationships for Incoming Incidents > Configure a Source Node Filter for a Causal Rule

Configure a Source Node Filter for a Causal Rule

The Source Node Filter tab enables you to create a filter to specify which Source Node should be used for the Parent Incident that is generated for this Causal Rule.

Note Create only one Source Node Filter for a Causal Rule. If you select Use Child Incident's Source Node for Parent, NNMi ignores any Source Node Filter you configure.

For information about each Causal Rules tab: Concept Link IconSee Also

For information about each Child Incident tab: Concept Link IconSee Also

Use the Filter Editor Buttons to insert Boolean Operators and to append, insert, and replace expressions in the Filter String. Use the Drag and Drop feature to make changes to the placement of the expressions in your Filter String. ClosedClick here for more information about using the Filter Editor:
  • You can use Custom Incident Attributes, attributes for an incident's Source Node, or both to define how matching incidents should be considered for the Causal Rule. See Valid Attributes  for more information.
  • When specifying Attribute names and values, NNMi uses the type to determine a match. For example, if the Attribute type is Integer, NNMi does a numeric comparison. If the Attribute type is textual, NNMi does a lexographical string comparison. In all cases, when you use the like or not like operator, NNMi uses a lexographical string comparison.
  • Each set of expressions associated with a Boolean Operator is treated as if it were enclosed in parentheses and evaluated together.
  • View the expression displayed under Filter String to see the logic of the expression as it is created.

  • The AND and OR Boolean Operators must contain at least two expressions.

  • The placement of your cursor and the subsequent text that is selected is important when performing operations using the Additional Filters Editor. For example, you append to or replace, the expression that is selected.
  • The placement of your cursor and the subsequent text that is selected is especially important when adding your Boolean operators. See Add Boolean Operators in the Additional Filters Editor for more information.

 

    Filter Editor Buttons and Drag and Drop Feature
    Button or Feature Description
    Append Appends the current expression (Attribute, Operator, and Value) to the selected expression already included in the filter string.
    Insert Inserts the current expression (Attribute, Operator, and Value) in front of the cursor location within the Filter String.
    Replace Replaces the selected expression with the expression displayed Left or Right Expression.
    AND

    Inserts the AND Boolean Operator in the selected cursor location.

    Note View the expression displayed under Filter String to see the logic of the expression as it is created.
    OR

    Inserts the OR Boolean Operator in the current cursor location.

    Note View the expression displayed under Filter String to see the logic of the expression as it is created.
    Delete

    Deletes the selected expression.

    Note If the Boolean Operator is selected, the Filter Editor deletes all expressions associated with the Boolean Operator.
    Drag and Drop

    You can drag any of the following items to a new location in the Filter String:

    • Filter Editor Options: AND, OR, NOT, EXISTS, NOT EXISTS
    • Filter Expression (Attribute, Operator, and Value)

    When moving items in the Filter String, note the following:

    • Click the item you want to move before dragging it to a new location.
    • As you drag a selected item, an underline indicates the target location.
    • If you are moving the selection up, NNMi places the item above the target location.
    • If you are moving the selection down, NNMi places the item below the target location.
    • If you attempt to move the selection to an invalid target location, NNMi displays an error message.

To configure a Source Node Filter for a Causal Rule:

  1. ClosedNavigate to the Custom Correlation Configuration form:
    1. From the workspace navigation pane, select the  Configuration workspace.
    2. Expand the Incidents folder.
    3. Select Custom Correlation Configuration.
  2. Navigate to the Causal Rules tab.

  3. From the Causal Rules table toolbar, do one of the following:

    • To create a Causal Rule, click the New icon, and continue.
    • To edit a Causal Rule, click the Open icon in the row representing the Causal Rule you want to edit, and continue.
    • To delete a Causal Rule, click the  Delete icon.
  4. Create your Causal Rule. (See Configure a Causal Rule.)
  5. Create your Child Incident Configuration . (See Configure a Child Incident for a Causal Rule.)
  6. Optional. Configure a Child Incident Filter. (See Configure a Child Incident Filter for a Causal Rule.)
  7. Optional. Configure a Source Object Filter. (See Configure a Source Object Filter for a Causal Rule.)

  8. Optional. Configure a Source Node Filter. (See the tables that follow, starting with Filter Editor Settings.)

    Filter Editor Settings
    Setting Description
    Attribute

    The Attribute on which NNMi searches. See Valid Attributes below for a description of valid Attributes.
    Operator Use this Operator to establish the relationship between the Attribute and Expression. See Valid Operators in the table below for the description of each valid Operator.
    Expression Use the Expression to complete the criteria for the Parent Incident configuration. See Valid Expressions below for more information.
  9. Click  Save and Close to save your changes and return to the previous form.

Valid Attributes
Attribute Description
Attribute

The Attribute on which NNMi searches.

Note the following when specifying Attributes:

  • Boolean Attributes begin with "is" and must contain the value true or false.
  • If you use attributes that are valid for the Source Node, NNMi uses the Source Node when comparing values. If you use attributes that are valid for the Source Object, NNMi uses the Source Object when comparing values. You cannot use attributes that are valid for the Source Node and Source Object in the same filter.

    • When using attributes for a Source Object, the attribute must be valid for the incident's Source Object or NNMi does not find a match. For example, if you use the hostedOn attribute and the Source Object is not an interface, the correlation does not occur.

      Tip To check a Source Object for an incident, select the incident of interest, then select Open from the Lookup menu for the Source Object, and examine the Source Object form.

      A Source Object attribute value of None indicates that NNMi cannot identify the Source Object or the Source Object is a Node. If you want to match the incident, use one or more Source Node attributes.

  • Node Closed [click here for a list of attribute values]

    Use the following syntax to specify a Custom Attribute for a Node:

    valueOfNodeCa(<CA_Name>)

    For example: ${valueOfNodeCa(Location)} = USA

    Values from the Basics Attributes on the Node Form:

    • hostname (Hostname, case-sensitive)
    • mgmtIPAddress (Management Address)
    • isSnmpNode (SNMP Agent Enabled)
    • isNnmSystemLocal (NNMi Management Server)

    Values from the Node Form: General Tab:

    • sysName (System Name)
    • sysContact (System Contact)
    • sysLocation (System Location)
    • sysOidNode (System Object ID)

    Addresses from the Node Form: IP Addresses Tab:

    • hostedIPAddress (Address)

      Because NNMi uses a lexicographical compare when evaluating IP addresses, it is recommended that you use the like and not like operators to specify IP address ranges rather than using the following operators: >, >=, <, or <=.

    Unique Keys from the Node Form: Capabilities Tab:

    • capability (Unique Key of the Capability)

    Values from the Basics Attributes on the associated Device Profile Form:

    • devVendorNode (Device Vendor)
    • devFamillyNode (Device Family)

    Values from the associated entry on the Regional Manager Form: Connection Tab:

    • nnmSystemName (Hostname, case-sensitive)

      (NNMi Advanced) If the Global Network Management feature is enabled, this attribute value identifies a Regional Manager (NNMi management server).

Valid Operator Values
Operator Description
=

Finds all values equal to the value specified.

ClosedClick here for examples.

Match any incident with a CIA value of 5 and Object Identifier (OID) value of .1.3.6.1.4.1.9.9.106.2.0.1:

${valueOfCia(\Q.1.3.6.1.4.1.9.9.106.2.0.1\E)} = 5

!=

Finds all values not equal to the value specified.

ClosedClick here for an example.

Match any incident with a Source Node value that has a Device Vendor value not equal to Cisco:

${devVendorNode} != Cisco

<

Finds all values less than the value specified.

ClosedClick here for an example.

Match any incident with a CIA value less than 5 and Object Identifier (OID) value of .1.3.6.1.4.1.9.9.106.2.0.1:

${valueOfCia(\Q.1.3.6.1.4.1.9.9.106.2.0.1\E)} < 5

<=

Finds all values less than or equal to the value specified.

ClosedClick here for examples.

Match any incident with a CIA value less than or equal to 5 and Object Identifier (OID) value of .1.3.6.1.4.1.9.9.106.2.0.1:

${valueOfCia (\Q.1.3.6.1.4.1.9.9.106.2.0.1\E)} <= 5

>

Finds all values greater than the value specified.

ClosedClick here for an example.

Match any incident with a CIA value greater than 5 and Object Identifier (OID) value of .1.3.6.1.4.1.9.9.106.2.0.1:

${valueOfCia (\Q.1.3.6.1.4.1.9.9.106.2.0.1\E)} > 5
>=

Finds all values greater than or equal to the value specified.
is not null

Finds all non-blank values.

ClosedClick here for an example.

Match any incident with a Source Node that has a (system contact name) sysContact value:

${sysContact} is not null

is null

Finds all blank values.

ClosedClick here for an example.

Match any incident with a Source Node that does not have a (system contact name) sysContact value:

${sysContact} is null

like

Finds matches using wildcard characters and the question mark.

The asterisk (*) character means any number of characters of any type at this location.

The question mark (?) character means any single character of any type at this location.

ClosedClick here for an example.

Match any incident with a Source Node that has a (system location) sysLocation value that begins with Bldg5:

${syslocation} like Bldg5*

not like

Finds all matches that do not have the values specified.

The asterisk (*) characters means any number of characters of any type at this location.

The question mark (?) character means any single character of any type at this location.

ClosedClick here for an example.

Match any incident with a Source Node that has a (system location) sysLocation value that does not begin with Bldg5:

${sysLocation} not like Bldg5*

Valid Expressions
Attribute Description
Expression

The value or pattern for which you want NNMi to search.

Note the following:

  • The expression can include a valid Attribute.

  • The value or pattern you want to match is case sensitive.

Send Help Center feedback