Search for	Example	Results
A single word	`cat`	Topics that contain the word "cat". You will also find its grammatical variations, such as "cats".
A phrase. You can specify that the search results contain a specific phrase.	`"cat food"` (quotation marks)	Topics that contain the literal phrase "cat food" and all its grammatical variations. Without the quotation marks, the query is equivalent to specifying an OR operator, which finds topics with one of the individual words instead of the phrase.

Search for	Operator	Example
Two or more words in the same topic	`AND` `and` `+` (plus symbol) `&` (ampersand)	`cat AND dog` `"cat food"+milk` `"cat food"&"dog food"`
Either word in a topic	`OR` `or` `\|` (pipe)	`cat OR dog` `cat \| dog`
Topics that do not contain a specific word or phrase	`NOT` `not` `!` (exclamation point)	`NOT cat` `! dog`
Topics that contain one string and do not contain another	`^` (caret)	`cat ^ mouse`
A combination of search types	`( )` parentheses	`cat + (dog \| mouse)` `cat \| dog + (! mouse)`

Operations Manager i10.62

Administer > Event Processing > Event Processing Customizations > Change the state of related events automatically

Change the state of related events automatically

Basic event correlation can change the lifecycle state existing events to closed or resolved. A new event is considered as being related to an existing event, when it provides specific information like a close key pattern that matches the key of the existing event, or when it contains an updated value of a health-contributing ETI for a specific CI, which out-dates a value of that specific ETI that is contained in an existing event. Both conditions result in changing the state of the existing event. (In OM, this form of correlation is also known as good/bad message correlation.)

Note Existing events must have the same CI and ETI as the new event, but a different ETI value. The ETI must contributes to health. Default value of the Operations Management Infrastructure Setting Detected Related Events by ETI is set to true.

Change state of related events settings

Changing the state of related events can be controlled using the settings available under Change State of Related Events Settings in the Operations Management Infrastructure Settings. There are two ways of detecting related events:

Existing events must have the same CI and the same ETI contributing to health as the new event, but a different ETI value.

Example:
- Event A for a certain CI has ETI SQL Query Performance: Low
- Event B for same CI has ETI SQL Query Performance: High
- ETI SQL Query Performance is an HI
Event B closes event A. Automatic close is tracked in the event history.
Key of existing events must match the closeKeyPattern value of the new event.

Example:
- Event A has key value om-db.server.net_VP_SM_DB_Backup:start
- Event B has key value om-db.server.net_VP_SM_DB_Backup:pending
- Event C contains the closeKeyPattern value om-db.server.net_VP_SM_DB_Backup<*>
Events A and B are closed or resolved. Automatic state change is tracked in the event history.

For detailed information on the available setting, access Administration > Setup and Maintenance > Infrastructure Settings > Applications > Operations Management > Change State of Related Events Settings.

Close key pattern syntax

Dynamic parts of event text can be extracted and used as parameters to identify and close related events already received. The pattern-matching language enables you to very accurately specify the character string that you want to identify.

Note OMi uses a subset of the pattern matching functionality supported by OM.

The following characters are supported:

^ — identifies the beginning of the pattern.
$ — identifies the end of the pattern.
<*> — represents any string of zero or more characters (including separators). <*> can be used in a close-key pattern as many times as required.
<@> — matches one or more non-whitespace characters. Whitespace characters are [ \t\n\x0B\f\r].
| — Logical or: X|Y matches pattern X or pattern Y.
X[Y|Z] — Grouping: grouping and delimiter for logical or.
\ — can be used to escape one '|', '[', or ']' so that they are treated as literals.

Note HPE recommends to use the identifiers for the beginning and ending of a pattern to avoid performance issues.

The following table illustrates how the event keys are identified:

closeKeyPattern Syntax	Usage
abc	Any occurrence of the text abc in the event key.
ab\|cd	Matches any occurrence of the text ab or cd in the event key.
[ab\|c]d	Matches any occurrence of the text abd or cd in the event key.
a\\|b\[c\]	Pattern a\|b[c] is found.
a<>b<>c	Any occurrence of the pattern *abc* in the event key where a can be separated from the b by any number of characters and the b can be separated from the c by any number of characters.
^abc$	Pattern abc is the complete event key.
^abc	Pattern abc is found at the beginning of the event key.
abc$	Pattern abc is found at the end of the event key.
<@>	For example, pattern " " or " " is found.

Send Help Center feedback