Correlation Rule Example

The NNMi Custom Correlation feature enables you to correlate groups of incidents under a Parent Incident. This feature is useful when you want to define a relationship between a number of incidents potentially from different network objects that form a logical set to identify a problem. The set of correlations is considered complete if all of the incidents arrive within a specified time window. You can correlate incidents under an existing Incident Configuration (Correlation Rule) or create a new Incident Configuration (Causal Rule).

1. Navigate to the Custom Correlation Configuration form:

   1. From the workspace navigation pane, select the  Configuration workspace.
   2. Expand the Incidents folder.
   3. Select Custom Correlation Configuration.
2. Navigate to the Correlation Rules tab.
3. From the Correlation Rules table toolbar, click the New icon.
4. In the Name attribute, enter a unique name that will help you to identify the Correlation Rule. In this example, the Correlation Rule Name is Subinterface.
5. In the Author attribute, enter a name that identifies the person who is creating the Correlation Rule. In this example, Network Node Manager is the Author name to identify this Correlation Rule as one that NNMi provides.
6. Make sure Enabled  is checked to indicate the NNMi Causal Engine should use this Correlation Rule when evaluating incidents.

7. To use an existing Parent Incident, do the following:

   1. In the Parent Incident Lookup Field, select Quick Find to select from the list of existing incident configurations.

   2. In the Subinterface Correlation Rule, the InterfaceDown incident configuration was selected as the Parent Incident.

8. Select the Incident Configuration that must match an incoming incident and that should be correlated as the Child Incident for the Custom Correlation.

   In the Subinterface Correlation Rule, the InterfaceDown incident configuration was also selected as the Child Incident.

9. In the Correlation Window Duration attribute, enter the time limit (in days, hours, minutes, and seconds) that must be reached before the incoming incident are correlated. The Subinterface Correlation Rule specifies a Correlation Window Duration of 6 minutes.

10. Use the Description attribute to provide additional information that you would like to store about the current incident configuration. This description applies only to the configuration entry.

    The Subinterface Correlation Rule includes the following description: Correlates sub-interfaces down incidents under the main interface down.

1. In the Correlation Rule form, navigate to the Parent Incident Filter tab.

2. The following Parent Incident Filter specifies that the Correlation Rule applies only to Cisco devices:

   ${devVendorInterface} = Cisco

3. The following Parent Incident Filter specifies that the ifDesc value must contain the string Serial followed by one or more digits and then a forward slash, followed by zero or more digits:

   ${ifDesc} like Serial\d+/*\d*

4. As shown in the following Filter String, the Parent Incident Filters use the Boolean operator AND so that both criteria must be met for the Incident to be selected as a Parent:

   {${devVendorInterface} = Cisco AND ${ifDesc} like Serial\d+/*\d*)

   To create this Parent Incident Filter, in the Filter Editor:

   1. Click And.
   2. In the Attribute field, enter ${devVendorInterface}.
   3. In the Operator field, select = from the drop-down menu.
   4. In the Expression field, enter Cisco.
   5. Click Append.
   6. In the Attribute field, enter ${ifDesc}.
   7. In the Operator field, select like from the drop-down menu.
   8. In the Expression field, enter Serial\d+/*\d*.
   9. Click Add.

1. In the Correlation Rule form, navigate to the Child Incident Filter tab.

2. The following Child Incident Filter specifies that the Correlation Rule applies only to Cisco devices:

   ${devVendorInterface} = Cisco

3. The following Child Incident Filter specifies that the ifDesc value must contain the following sequence of values:

   The string Serial followed by one or more digits, then a forward slash, followed by zero or more digits, and then a period followed by one or more digits:

   ${ifDesc} like Serial\d+/*\d*

4. As shown in the following Filter String, the Child Incident Filters use the Boolean operator AND so that both criteria must be met for the Incident to be selected as a Child:

   {${devVendorInterface} = Cisco AND ${ifDesc} like Serial\d+/*\d*)

   To create this Parent Incident Filter, in the Filter Editor:

   1. Click And.
   2. In the Attribute field, enter ${devVendorInterface}.
   3. In the Operator field, select = from the drop-down menu.
   4. In the Expression field, enter Cisco.
   5. Click Append.
   6. In the Attribute field, enter ${ifDesc}.
   7. In the Operator field, select like from the drop-down menu.
   8. In the Expression field, enter Serial\d+/*\d*.
   9. Click Append.

1. In the Correlation Rule form, navigate to the Correlation Filter tab.

2. To ensure that the Interface Down incidents are generated for the same node, the Subinterface Correlation Rules uses hostedOn as the attribute for both the Child and Parent Incidents as shown in the following example filter:

   ${child.hostedOn}= ${parent.hostedOn}

   To ensure that the Interfaces are subinterfaces for the main interface, the filter also matches the ifDesc values:

   ${child.ifDesc} like ${parent.ifDesc}.*

   As shown in the following Filter String, the Correlation Filter uses the Boolean operator AND so that both criteria must be met for the Incidents to be correlated:

   ${child.hostedOn} = ${parent.hostedOn} AND ${child.ifDesc} like ${parent.ifDesc}.*

   To create the Correlation Rule filter:

   1. Click And.
   2. In the Attribute field, enter ${child.hostedOn}.
   3. In the Operator field, select = from the drop-down menu.
   4. In the Expression field, enter ${parent.hostedOn}.
   5. Click Append.
   6. In the Attribute field, enter ${child.ifDesc}.
   7. In the Operator field, select like from the drop-down menu.
   8. In the Expression field, enter ${parent.ifDesc}.*.
   9. Click Append.
3. Click  Save and Close to save your changes and return to the previous form.