Configure Topology-based Event Correlation Rules

This task describes how to configure a topology-based event correlation rule. A correlation rule uses multiple indicator states to determine which events are symptoms of a problem and which events are the causes.

1. Prerequisites

   To create correlation rules and policies, you need the following:

   • Access to Operations Management Administration.

   • Good understanding of the principles of event correlation.

   • Detailed knowledge of the objects and events that you want to create rules to correlate.

   • Working knowledge of configuration item types, indicators, and indicator states.

   • Understanding of how events relate to each other in terms of cause and effect. For example, the availability of an email server depends on reliable hardware, responsive software, and a functioning network.

2. Create the Event Correlation Rule

   In this step, you create a correlation rule to help you solve problems more quickly by distinguishing between events that are the symptoms of a problem and events that are the cause. For more information, see Create Event Correlation Rules.

3. Select a Topology View

   In this step, you select a view that specifies the configuration item types you want to use in a correlation rule. Topology views reduce and refine the number of configuration item types that you can use in the correlation rule to a more manageable level. For more information, see Select Topology Views.

4. Define the Rule Topology

   In this step, you define the topology of the correlation rule. Topology is the relationships and dependencies between the configuration item types in the correlation rule. For more information, see Define the Rule Topology.

5. Specify Event Correlation Rule Symptoms

   In this step, you specify one or more events as symptoms in a correlation rule. You define the symptoms of a correlation rule by specifying one or more indicator states used to monitor particular events in your IT environment, for example: Database:Unavailable or Service:Slow. For more information, see Specify Correlation Rule Symptoms.

6. Specify Correlation Rule Cause

   In this step, you specify the event that you want to define as the cause in a correlation rule. You define the cause of a correlation rule by specifying an indicator state used to monitor a particular event in your IT environment, for example, Network:Unreachable. For more information, see Specify Correlation Rule Causes.