Administer > Event Processing > Stream-Based Event Correlation

Stream-Based Event Correlation

Stream-based event correlation (SBEC) uses rules and filters to identify commonly occurring events or combinations of events and helps simplify the handling of such events by automatically identifying events that can be withheld, removed or need a new event to be generated and displayed to the operators.

The following types of SBEC rules can be configured:

  • Repetition Rules: Frequent repetitions of the same event may indicate a problem that requires attention.
  • Combination Rules: A combination of different events occurring together or in a particular order indicates an issue, and requires special treatment.
  • Missing Recurrence Rules: A regularly recurring event is missing, for example, a regular heartbeat event does not arrive when expected.

SBEC rules are processed in the order defined in the rules list. Modifications are executed as soon as the rule is matched, and subsequent rules see modifications done by earlier rules.