The NNMi Causal Engine and Incidents

The Causal Engine extensively evaluates network issues and determines the root cause for you, whenever possible, sending incidents to notify you of problems.

The NNMi Causal Engine defines root cause in terms of symptoms. To do so, it uses a set of rules to define relationships for fault and performance (thresholding) symptoms and root causes. Sources of symptom information include SNMP traps and the monitoring information from the State Poller, which includes an object's State. See The NNMi Causal Engine and Object Status and How NNMi Gathers Incidents for more information.

The NNMi Causal Engine performs the following tasks:

• Generates notifications about problems.
• Generates conclusions that relate to the root cause of the problem.

• Determines whether the incident should be correlated or suppressed.

  Tip An incident that is correlated with a Root Cause Parent Incident has a Correlation Nature of  Secondary Root Cause. These incidents can be examined using the All Incidents view, but do not appear as Key Incidents or Root Cause incidents. See Incident Views Provided by NNMi for more information.

  Incident correlation scenario (click here)

  The NodeDown incident correlates the InterfaceDown incident from one-hop neighbor interfaces, according to the following scenario:

  When an interface goes down, a NodeDown episode begins for the neighboring node, which exists for the duration of 300 seconds.

  Within that duration, if the node goes down, the InterfaceDown incident is correlated with the NodeDown incident.

  The InterfaceDown incidents from all one-hop neighbors are correlated with the NodeDown incident. The network operator can review the InterfaceDown incidents as supporting evidence for the NodeDown incident.

  Incident suppression scenario (click here)

  The AddressNotResponding incident is suppressed by the InterfaceDown incident, according to the following scenario:

  When an IPv4 address stops responding to ICMP, an episode begins, which exists for the duration of 60 seconds.

  Within that duration, if the interface associated with that IPv4 address goes down, the Causal Engine concludes that the interface down condition caused the IPv4 address to stop responding.

  Therefore, the AddressNotResponding incident is not generated. Only the InterfaceDown incident is generated.

  To ensure that the InterfaceDown incident is detected within the duration, the Causal Engine issues a named poll for that interface. The incident enables the network engineer to fix the root cause of the problem which, in this case, is the interface.

  If the interface does not go down during the episode, the Causal Engine generates an AddressNotResponding incident. If the interface goes down after the episode, NNMi generates the InterfaceDown incident. In this case, the network engineer has to treat the two problems separately.

• Closes incidents that are no longer valid (for example, when a "Cold Start" trap is received a short time after a "Node Down" incident was generated because a device was recently rebooted).
• Creates a parent-child relationship between incidents that are all related to one problem (for example, a "Node Down" incident contains a child "Interface Down" incident for each neighboring interface of the node).
• Creates parent-child relationships between incidents that are correlated using the Custom Correlation configuration. NNMi's Custom Correlation feature enables administrators to add customized rules for when and how to correlate incidents. See Configure Custom Correlations for more information.

The Causal Engine actively solicits symptoms during analysis and reacts dynamically to topology changes. The Causal Engine uses the following three stages to help determine and display root cause incidents and their related conclusions.

NNMi Causal Engine Stages

Causal Engine Stages	Description
Condition Listener	Collects symptoms from NNMi processes and services.
Hypothesis engine	Analyzes these symptoms to determine relationships until a root cause is reached.
Blackboard	Based on the information sent by the hypothesis engine, the blackboard updates a device's status and posts any related incidents.

The NNMi Causal Engine analyzes the health of your network and provides the ongoing health Status reading for each object it monitors. See The NNMi Causal Engine and Object Status and The NNMi Causal Engine and Monitoring for more information.

Related Topics

The NNMi Causal Engine and Object Status