Active Event Count in KPIs

1. Open the Infrastructure Settings in Administration:

   Administration > Setup and Maintenance > Infrastructure Settings

   Alternatively, click Infrastructure Settings.

2. Select Applications and use the list to set the administration context to Operations Management.

3. Go to the Health Indicators for Unresolved and Unassigned Events section which contains the available configurations used to specify the custom Event Count based HIs.

4. Open the Event Subcategories field and add the name of the new subcategory.

5. Optional. If necessary, open the Event Count Rule field and change the calculation method.

   The default setting is MOST_CRITICAL. The sum of the number of events with the highest severity is recorded by Service Health. For example, 1 critical event, 5 major events, and 2 normal event for the CI: My Web Server are active.

   The value displayed for the number of highest severity events for CI: My Web Server is: 1 and the highest severity Critical.

   AGGREGATIVE calculates the sum of all events related to CI: My Web Server. In this case, the value displayed for the number of events for CI: My Web Server is: 8 and the highest severity Critical.

   AGGREGATIVE_WITHOUT_NORMAL calculates the sum of all events related to CI: My Web Server but excludes any events with severity Normal. In this case, the value displayed for the number of events for CI: My Web Serveris: 6 and the highest severity Critical.

   The MOST_CRITICAL setting is designed to hide the information about the events which do not have the highest severity. When you close the highest severity events, the events with the next highest severity are displayed. In our example, closing the critical event changes the value of the KPI from 1 to 5, and the severity changes from Critical to Major. Initially, it would not be obvious that there were a number of events with the severity Major related to CI: My Web Server.

   To avoid this situation, select one of the other options: AGGREGATIVE or AGGREGATIVE_WITHOUT_NORMAL.

In our example, the corresponding ArcSight HIs are automatically generated.

1. Open the KPI Definitions page:

   Administration > Service Health > KPI Definitions

   Alternatively, click KPI Definitions.

2. In the central KPI Definitions pane, click New to open the Create Key Performance Indicator panel.

3. In the General section, complete the following information:

   1. Specify a name for the KPI. It is a good practice to use the subcategory name within the KPI name (for example, Unassigned ArcSight Events and Unresolved ArcSight Events).
   2. Specify the domain to which this KPI is assigned. In our example, this is System.

4. In the Rules section, specify Worst Status Rule as the default group rule. To do so, make sure you select it first from the drop-down list. In addition, add the following rules: API Group And Sibling Rule, Best Status Rule, and Event KPI Group And Sibling Rule (OMi).

5. Click Create.

6. Repeat the procedure for the second KPI (in our example, we need the following KPIs: Unassigned ArcSight Events and Unresolved ArcSight Events).

1. Open the KPI Assignments page:

   Administration > Service Health > KPI Assignments

   Alternatively, click KPI Assignments.

2. In the left pane, select ConfigurationItem.

3. In the central pane, select OMi KPI Assignments, and click Edit.

4. In the KPI Configurations section of the Edit KPI Assignment pane, click New KPI Configuration and add two new KPIs to the assignment (in our example, Unassigned ArcSight Events and Unresolved ArcSight Events) with the following configurations:

   • Business Rule: Worst Status Rule

   • Calculated Based on: HIs

   • Related HIs: The HI associated with the selected KPI

5. Click Apply All Rules for the assignment to take place on existing CIs.

1. Open the Propagation Rules page:

   Administration > Service Health > Propagation Rules

   Alternatively, click Propagation Rules.

2. In the left pane, select ConfigurationItem.

3. Click New or  Create , and add two new propagation rules, one for each new KPI:

   

Events that contain the associated subcategory (ArcSight, in our example) will be used to calculate the event count.