Indicator Mappings

• Event Type Indicators (ETI)

  Event type indicators indicate that a problem has occurred. They use the severity attribute from the event. This severity can be used to set an ETI state using the based on severity option. One indicator state is required. By default, the state Normal is created when creating an event type indicator.

  An ETI could read: System Restart: occurred.

  ETIs are necessary for topology-based event correlation.

• Health Indicators

  Health indicators (HI) are used to indicate the detailed health of CIs by setting a severity status. When an HI is defined, an associated event type indicator is automatically created. HIs are independent of the event lifecycle. You can close events, but the health of the associated CI is still available.

  For example, you can use the attributes of a critical event reporting a lack of storage space on a logical volume to set an HI state Down with the severity Critical assigned to the configuration item type Logical Disk.

  When assigned to KPIs, HIs are intended for use in the calculation of the severity status of health-based KPIs. However, HIs provide more fine grained information using the Status Snapshot.

  When HIs are configured to work in conjunction with KPIs, they show the effect of a problem on the CI's neighborhood in a clear and easy to understand way, by propagating the effect of a problem with a low-level CI to higher-level CIs using the Health Top View.

An event being sent from a manager, such as OM, to OMi signifies an occurrence in the managed environment. This event includes information about the source of the problem and could include health-related attributes. When this event is received by OMi, indicators are set based on this attribute. If the event attribute is not, or cannot be included, indicator mapping rules can be used to set indicators.

OMi uses HIs to determine and display the health of different aspects of a monitored object. An HI is an event-specific monitor that uses one or more states to represent the individual states of a monitored object, such as Running or Stopped. HIs can be used to show if a hardware resource is available and responding or, if the performance of a software application changes according to whether the load is normal, high, or exceeding specification.

OMi creates an HI in conjunction with an event type indicator. When creating an HI, the associated event type indicator is automatically created.

HIs monitor and show specific aspects of the health of the configuration item type to which they are assigned. A configuration item inherits HI assignments from its parent configuration item type. For example, HIs assigned to the configuration item type Database also apply to the configuration item type Oracle or DB2 and are applied to any Oracle and DB2 database configuration items.

HIs provide the data that key performance indicators (KPI) need to calculate the health-based severity status for the availability and performance of monitored resources. You assign HIs to KPI calculation rules, to collate health-related data, determine a configuration item's availability and performance, and indicate its overall health, for example, with a severity status and color.

An event can contain an EtiHint custom attribute. Based on this, the ETI/HI and its state are set automatically.

For events that do not include this custom attribute, you can define indicator mapping rules to set indicator states.

Indicator mapping rules are intended to help in the following situations:

• Monitoring events that are not integrated in either OMi or forwarded from OM.

• Integrating events from a custom application or a Smart Plug-in that is not OMi-ready.

The mapping of event attributes to indicator states occurs either through the installation and setup of an OMi content pack or as a result of a manually created indicator mapping rule.

You can set indicators in one of the following ways:

• at a specific event using indicator mapping rules

• by setting the indicator with an OM message policy

Indicator mapping rules exist in the context of a specific type of configuration item, for example, Computer, Host, or Router. The indicator mapping rules defined for a specific configuration item type can use only the indicators assigned to the specified configuration item type.

You can define indicator mapping rules that search filtered events for strings and values which are then used to set an indicator state. If the mapped indicator sets an HI, the corresponding state for the HI is also set. For more detailed information about defining filters, see Event Filters.

Using the Manage Event Filters dialog box, you can define filters that target the events to be considered in an indicator mapping rule. The filter can use any of the available event attributes. For example, you can define an indicator mapping rule that considers only those events that have a critical or major severity status and are assigned to a particular user or user group.

An indicator mapping rule filter can only be used with indicator mapping rules. They are not interchangeable with event filters.

If overriding of automatic settings is enabled, but the event matches an indicator mapping rule filter, the rule maps the event to the specified indicator.

The state of the indicator is set by one of the following methods:

• Specific Indicator State

  The event is mapped to an indicator which is set to the state specified in the mapping rule.

  For example, you are monitoring databases and OMi receives an event that matches the mapping rule filter of the Database Status indicator. The event sets the indicator state that is specified in the mapping rule, for example, Down.

• Based On Severity

  Events matching the mapping rule filter are assigned the severity associated with the indicator state that matches the severity of the event.

  For example, you are monitoring the CPU load and OMi receives an event that matches the mapping rule filter of the CPU Load indicator and has a severity of major. The event automatically sets the indicator state that is specified to correspond to this severity, for example, Overloaded.

  Note If no obvious indicator state is available for Based on Severity mapping, OMi uses the nearest available state. For example, if a Critical event is mapped to an event type indicator that only has states of Major and Normal severities, OMi maps critical events to the event type indicator state with severity Major.

  If you define multiple states with the same severity, mapping is undefined.

If an event generated by an OM Smart Plug-in uses custom attributes to set an indicator state automatically, you can configure OMi to override this automatic setting and set the indicator state in accordance with an indicator mapping rule. For further information, see the Event Type Indicator Settings.

You can create many indicator mapping rules for a CI type. Where more than one indicator mapping rule is available for a configuration item type, the number in the Order column indicates the order in which the indicator mapping rules are applied during the mapping process. As soon as one indicator mapping rule matches, the mapping process stops and ignores all subsequent rules further down the specified order.

The indicator mapping rules configured for a CI type and inherited from higher-level CI types are listed in the Mapping Overview pane. The indicator mapping rules configured for each CI type are listed in the Mapping Rules list for their respective CI type names. You can change the order of the indicator mapping rules only for the selected CI type.

A CI type inherits indicator mapping rules from CI types higher in the hierarchy. An indicator mapping rule defined for the Host configuration item type is inherited by all configuration items types lower in the hierarchy, such as Unix, and Windows.

You can control which configuration items inherit defined indicator mapping rules by choosing the level in the configuration item hierarchy at which to define them. The higher in the CI type hierarchy the mapping rule is specified, the greater the number of CI types that inherit it.

The Mapping Overview pane shows the inheritance of indicator mapping rules in the reverse order of the CI types in the CI Types tree.

• Show only CI types with assigned indicator mapping rules

• View (Show CI types contained within a specified view)

Searching for a CI type

You can use the Search field to locate the first instance of the CI type name or part of a name that you specify.

To search for a specified CI type:

1. Open the Indicator Mapping Rules manager:

   Administration > Event Processing > Automation > Indicator Mappings

   Alternatively, click Indicator Mappings.

2. In the Search field, enter a string.

   Note The search string must be at least three characters long. Searching is started as soon as the third character is entered and the first match is highlighted. Names with less than three characters can be found by clicking on the  Search Content button.

   The first CI type in the CI Types tree to match the specified string is highlighted. If that CI is not initially visible, the CI tree is expanded to display the CI type.

3. Click the  Search Content button to find the next occurrence of the CI type for which you are searching.

Finding CI types with assigned indicators

You can use the filter to display all CI types that have indicators assigned to them.

To filter the CI tree to show only CI types with assigned indicator mapping rules:

1. Open the Indicators Mapping Rules manager:

   Administration > Event Processing > Automation > Indicator Mappings

2. In the Filter pane, select Show only CI types with assigned indicator mapping rules.

   The CI Types pane displays only those CI types that have indicators assigned along with the parents of these CI types. If a parent CI type has no assigned indicators, they are unavailable in the display.

   Note You can use the Show only CI types with assigned indicator mapping rules filter and the filtering by a selected view together. The result displays only CI types contained within the specified view and with assigned indicators.

Filtering the CI Types Tree with a view

You can use the filter to display all CI types that are contained within a certain view.

Note Join relationships defined in views are ignored.

To filter the CI Types tree with a view:

1. Open the Indicator Mapping Rules manager:

   Administration > Event Processing > Automation > Indicator Mappings

2. Expand the Filters pane, select View.

   The View field becomes active.

3. Select a view from the Views list or click the Browse Views (...) button to open the Views selection dialog box, select the view that you want to use, and select OK.

   The CI Types tree is updated to display only the CI types that match the view selected.

   If no item matches the filter, the No CI type found that match the filter message is displayed.

   Note You can use the Show only CI types with assigned indicator mapping rules filter and the filtering by a selected view together. The result displays only CI types contained within the specified view and with assigned indicators.

In this task, you learn how to set up an indicator mapping rule that searches filtered events for attribute values that are then used to set an indicator state. If the mapped indicator sets an HI, the corresponding state for the HI is also set.

To define an indicator mapping rule:

1. Open the Indicator Mapping Rules manager:

   Administration > Event Processing > Automation > Indicator Mappings

2. Select the CI type for which you want to define an Indicator Mapping Rule.

3. To create or edit indicator mapping rules, in the Indicator Mapping Rules pane, use the New Item button to open the Create New Mapping Rule, or use the  Edit Item button to open the Edit Mapping Rule dialog box for an existing indicator mapping rule.

   The Create New Mapping Rule or Edit Mapping Rule dialog box opens.

   Note Use the  Duplicate Item button to create a mapping rule that is similar to an existing mapping rule.

4. Enter a Display Name, Name, and a short description for the new mapping rule.

5. Optional. Select Active to include the current mapping rule in the matching process.

   Clearing Active, disables an indicator mapping rule. This can be useful if you want to exclude an indicator mapping rule from a list of rules for testing purposes.

6. Select an event filter for the mapping rule from the Events Filter list. The filter determines which events to consider in the mapping operation.

   If no appropriate filter is already configured, click the Browse (...) button, which opens the Manage Event Filters side panel. Create a filter or edit an existing one. For information about filters, see Event Filters.

7. Select an Event Type Indicator.

   Note Only indicators associated with the selected CI are shown in the Select Indicator dialog box. Indicators inherited from parent CIs are not displayed.

   The indicator that you want to select must already be available. If a suitable indicator is not available, first create it and then create the ETI Mapping Rule.

   The Launch Indicator Manager button in the Indicator Mapping Rules menu bar opens the Indicators manager.

8. Select a Map to Indicator State mode.

   An event attribute value must be mapped to an indicator state, using one of the following methods:

   • Based on Severity (information from the event)

   • Specific Indicator State (can be selected in the mapping rule)

   Note If no obvious indicator state is available for Based on Severity mapping, Operations Management uses the nearest available state. For example, if a Critical event is mapped to an event type indicator that only has states of Major and Normal severities, Operations Management maps critical events to the event type indicator state with severity Major.

   If you define multiple states with the same severity, mapping is undefined.

9. Select OK to save your changes.

   The new indicator mapping rule is added to the end of the list of indicator mapping rules displayed in the Indicator Mapping Rules pane.

In this task, you learn how to change the order of indicator mapping rules.

To change the order of execution of an indicator mapping rule:

1. Open the Indicator Mapping Rules manager:

   Administration > Event Processing > Automation > Indicator Mappings

2. Select the CI type for which you want to change the order of the indicator mapping rules, for example:

   ConfigurationItem > InfrastructureElement > Node > Computer > Windows

3. Select the mapping rule for which you want to change the order.

4. Using the Move Up and Move Down buttons, rearrange the order of the selected mapping rule and repeat for any other indicator mapping rules that you want to move.

   The order of the indicator mapping rules, including inherited rules, can also be seen in the Mapping Overview pane.

   Note Reordering rules has an effect on lower CI type levels. For example, if you reorder rules for Computer, this change is made on both the Windows and Computer level.