About Pairwise Configurations

Often two incidents have a logical relationship to each other, for example, CiscoLinkDown followed by CiscoLinkUp. There is no need for both incidents to take up room in your Incident view. Nesting the two together helps you do your job quickly and efficiently.

Use the Pairwise Configuration to pair up the occurrence of one incident with another subsequent incident. When the second incident in the pair occurs, the first incident becomes a correlated child incident within the parent incident. See Incident Pair (Pairwise) Configurations Provided by NNMi for ideas.

When using Pairwise Configurations, note the following:

• You can use Payload Filters (for example, with trap varbinds) to identify the first and second incidents in a Pairwise Configuration.
• You can specify the same incident (for example, the same trap OID) as both the first and second incident configuration for a Pairwise Configuration.
• Using the Payload Filter to distinguish the first and second incidents (the first could represent a non-normal state and the second a normal state), different instances of the same incident configuration can cancel one another.
• You can also set up the Payload Filters such that the same incident instance cancels itself.

• You can use the same incident configuration in multiple Pairwise Configurations. For example:

  • Incident configuration A cancels both incident configuration B and incident configuration C
  • Incident configuration A cancels incident configuration B and incident configuration B cancels incident configuration C.

• Single incident instance can cancel multiple incident instances (for example, one Link Up trap cancels multiple instances of a Link Down trap).

  Note If multiple Link Up/Link Down trap pairs are received within a 30 seconds, NNMi investigates only once (generates SNMP traffic).

• Use the Duration time to specify the time in which the second incident configuration cancels the first incident configuration. This Duration is calculated from the originOccurrenceTime of the second incident backwards in time, canceling any number of first incidents within the Duration specified.
• You can also specify whether to delete any incidents that were canceled according to the Pairwise Configuration and that occurred within the time period specified by the Duration attribute.

• When matching incidents, NNMi automatically takes into account the following values:

  • SNMP Trap incidents. NNMi takes into account from which device the trap originated using the cia.address value of the source address of the trap.

  • Management Event incidents. NNMi takes into account the name of the incident's Source Object and Source Node.

    Tip NNMi displays the Name value used to identify the Source Node and Source Object in the Source Node and Source Object attribute for each incident in the Incident form.

  • Syslog Message incidents. NNMi does not automatically use any matching criteria.

Some incident pairs require extensive details to verify an accurate match. If both incidents have custom incident attributes, you can refine the match criteria beyond the values that NNMi automatically takes into account. See Matching Criteria Configuration Form (Identify Incident Pairs) and Configure a Payload Filter to Enrich a Pairwise Incident Configuration for more information.

Related Topics:

Prerequisites for Pairwise Configurations

Pairwise Configuration Form (Correlate Pairs of Incidents)