Administer > Configure Incidents > Manage Incidents Using Incident Configurations > Manage the Number of Incoming Incidents > Establish Criteria or Relationships for Incoming Incidents > Causal Rule Example

Causal Rule Example

Tip Use these steps as a guideline for creating your own Causal Rules.

This example creates a Causal Rule that generates a new CardHealthProblem Parent Incident. It uses the traps described in the following table to determine the following:

• Whether there is a temperature problem or diagnostic failure for a Field Replaceable Unit (FRU) Card module

• Whether the source of the problem is a fan, a power supply, or both.

Trap Descriptions
Trap Description
FruModuleStatusChange Indicates a temperature problem (14) or diagnostic failure (11) for the Field Replaceable Unit (FRU) card module
CiscoEnvMonFanNotification Physical Sensor object incident: Indicates the problem is related to a fan. The example Causal Rule uses this trap to obtain the name of the fan.
CiscoEnvMonSuppStatusChangeNotif Physical Sensor object incident: Indicates the problem is related to the Power Supply.

Using the Causal Rule described in this example, NNMi generates a new CardHealthProblem Parent Incident when NNMi determines the following:

  • The Source Object for the Child Incident is a Field Replaceable Unit (FRU) card.

    Note NNMi checks for the com.hp.nnm.capability.card.fru capability to determine whether the Source Object is an FRU card.

  • The FruModuleStatusChange trap returns a value of either 14 (temperature problem) or 11 (diagnostic failure).
ClosedTo configure the CardHealth Causal Rule Basics information:
  1. ClosedNavigate to the Causal Rule form:
    1. From the workspace navigation pane, select the  Configuration workspace.
    2. Expand the Incidents folder.
    3. Select Custom Correlation Configuration.
  2. Navigate to the Causal Rules tab.
  3. From the Causal Rules table toolbar, click the New icon.
  4. In the Name attribute, enter a unique name that will help you to identify the Causal Rule. In this example, the Causal Rule Name is Card Health.
  5. In the Author attribute, either enter a name that identifies the person who is creating the Causal Rule or keep the default value Customer.
  6. Make sure Enabled  is checked to indicate the NNMi Causal Engine should use this Causal Rule when evaluating incidents.
  7. To create a new Incident  Configuration for the Parent Incident, in the Parent Incident Lookup Field, select New.

  8. In the Management Event Configuration form, enter the Basics information as follows:

    1. In the Name attribute, enter CardHealthProblem for the Name value.
    2. Make sure Enabled  is checked to indicate the NNMi Causal Engine should use this Causal Rule when evaluating incidents.
    3. In the Categories Lookup Field, select Quick Find and select Fault from the list of incident Categories.
    4. In the Family Lookup Field, select Quick Find and then Card from the list of incident Families.
    5. In the Severity Lookup Field, select Quick Find and then Critical from the list of incident Severities.

    6. In the Message Format attribute, enter the following: Card $.1.3.6.1.2.1.47.1.1.1.1.7.5000 with $.1.3.6.1.4.1.9.9.13.1.4.1.2 and Power Supply not functioning

      NNMi displays the name of the Card using the Object Identifier (OID) value of $.1.3.6.1.2.1.47.1.1.1.1.7.5000. NNMi displays the name of the Fan using the OID value of $.1.3.6.1.4.1.9.9.13.1.4.1.2.

    7. Click Save and Close to save your changes and return to the Causal Rule form.
  9. In the Correlation Nature select  Root Cause from the drop-down list.
  10. In Common Child Incident Attribute, enter ${hostname}.
  11. In the Correlation Window Duration attribute, keep the default value of 5 minutes.
  12. Use the Description attribute to provide additional information that you would like to store about the current incident configuration. This description applies only to the configuration entry.
ClosedTo configure the first Child Incident (CiscoModuleStatusChange):
  1. In the Causal Rule form, navigate to the Child Incidents tab.
  2. Click the New icon to configure the first Child Incident.
  3. In the Name attribute of the Child Incident Configuration form, enter FRU Card.
  4. In the Child Incident Lookup Field, select Quick Find and then CiscoModuleStatusChange from the list of incident configurations.
  5. To forward the Card name to the new Parent Incident, in Forward Child Custom Incident Attributes, enter .1.3.6.1.2.1.47.1.1.1.1.7.5000.
  6. Check to enable Use Child Incident's Source Object for Parent .
  7. Check to enable Use Child Incident's Source Node for Parent .
ClosedTo configure the first Child Incident Filter:

  1. In the Child Incident Configuration form, navigate to the Child Incident Filter tab.

    Next, create the following filter: (capability = com.hp.nnm.capability.card.fru AND ${valueOfCia(\Q.1.3.6.1.4.1.9.9.117.1.2.1.1.2.5000\E)} = 11) OR  ${valueOfCia(\Q.1.3.6.1.4.1.9.9.117.1.2.1.1.2.5000\E)} = 14)

  2. In the Attribute field, enter capability.
  3. In the Operator field, select = from the drop-down menu.
  4. In the Expression field, enter com.hp.nnm.capability.card.fru.
  5. Click Append.
  6. Select Insert from the drop-down menu.
  7. Click AND.
  8. Click to select AND in the Child Incident Filter Expression.
  9. Select Append from the drop-down menu.
  10. Click OR.
  11. Click to select OR in the Child Incident Filter Expression.
  12. In the Attribute field, enter ${valueOfCia(\Q.1.3.6.1.4.1.9.9.117.1.2.1.1.2.5000\E)}.
  13. In the Operator field, select = from the drop-down menu.
  14. In the Expression field, enter 11.
  15. Click Append.
  16. In the Attribute field, enter ${valueOfCia(\Q.1.3.6.1.4.1.9.9.117.1.2.1.1.2.5000\E)}.
  17. In the Operator field, select = from the drop-down menu.
  18. In the Expression field, enter 14.
  19. Click to select OR in the Child Incident Filter Expression.
  20. Click Append.
  21. Click Save and Close to return to the Causal Rule form.
ClosedTo configure the second Child Incident (CiscoEnvMonFanNotification):
  1. In the Causal Rule form, navigate to the Child Incidents tab.
  2. Click the New icon to configure the second Child Incident.
  3. In the Name attribute of the Child Incident Configuration form, enter Chassis Fan.
  4. In the Child Incident Lookup Field, select Quick Find and then CiscoEnvMonFanNotification from the list of incident configurations.
  5. To forward the Fan name to the new Parent Incident, in Forward Child Custom Incident Attributes, enter .1.3.6.1.2.1.47.1.1.1.1.7.5000.
ClosedTo configure the second Child Incident Filter:

  1. In the Child Incident Configuration form, navigate to the Child Incident Filter tab.

    Next, create the following filter: (${valueOfCia(\Q.1.3.6.1.4.1.9.9.13.1.4.1.2\E)} = Chassis Fan Tray 1 AND ${valueOfCia(\Q.1.3.6.1.4.1.9.9.13.1.4.1.3\E)} = 3)

  2. In the Attribute field, enter ${valueOfCia(\Q.1.3.6.1.4.1.9.9.13.1.4.1.2\E)}.
  3. In the Operator field, select = from the drop-down menu.
  4. In the Expression field, enter Chassis Fan Tray 1.
  5. Click Append.
  6. Select Insert from the drop-down menu.
  7. Click AND.
  8. In the Attribute field, enter ${valueOfCia(\Q.1.3.6.1.4.1.9.9.13.1.4.1.3\E)}.
  9. In the Operator field, select = from the drop-down menu.
  10. In the Expression field, enter 3.
  11. Click Append.
  12. Click Save and Close to return to the Causal Rule form.
ClosedTo configure the third Child Incident (CiscoEnvMonSuppStatusChangeNotif):
  1. In the Causal Rule form, navigate to the Child Incidents tab.
  2. Click the New icon to configure the third Child Incident.
  3. In the Name attribute of the Child Incident Configuration form, enter Chassis Power.
  4. In the Child Incident Lookup Field, select Quick Find and then CiscoEnvMonSuppStatusChangeNotif from the list of incident configurations.
  5. To forward the Fan name to the new Parent Incident, in Forward Child Custom Incident Attributes, enter ${valueOfCia(\Q.1.3.6.1.4.1.9.9.13.1.4.1.2\E)}.
ClosedTo configure the third Child Incident Filter:

  1. In the Child Incident Configuration form, navigate to the Child Incident Filter tab.

    Next, create the following filter: (${valueOfCia(\Q.1.3.6.1.4.1.9.9.13.1.4.1.3\E} = 3} AND ${valueOfCia(\Q.1.3.6.1.4.1.9.9.117.1.2.1.1.2.5000\E} = Power Supply 1, WS-CAC-1300W)

  2. In the Attribute field, enter ${valueOfCia(\Q.1.3.6.1.4.1.9.9.13.1.4.1.3\E)}.

  3. In the Operator field, select = from the drop-down menu.
  4. In the Expression field, enter 3.
  5. Click Append.
  6. Select Insert from the drop-down menu.
  7. Click AND.
  8. In the Attribute field, enter ${valueOfCia(\Q.1.3.6.1.4.1.9.9.13.1.4.1.2\E)}.
  9. In the Operator field, select = from the drop-down menu.
  10. In the Expression field, enter Power Supply 1, WS-CAC-1300W.
  11. Click Append.
  12. Click Save and Close to save your changes and return to the Causal Rule form.
  13. Click Save and Close to save your changes and return to the Custom Correlation Configuration form.
  14. Click Save and Close to save the Custom Correlation Configuration.

See Correlation Rule Example for an example of creating a Correlation Rule.

Send Help Center feedback