Search for	Example	Results
A single word	`cat`	Topics that contain the word "cat". You will also find its grammatical variations, such as "cats".
A phrase. You can specify that the search results contain a specific phrase.	`"cat food"` (quotation marks)	Topics that contain the literal phrase "cat food" and all its grammatical variations. Without the quotation marks, the query is equivalent to specifying an OR operator, which finds topics with one of the individual words instead of the phrase.

Search for	Operator	Example
Two or more words in the same topic	`AND` `and` `+` (plus symbol) `&` (ampersand)	`cat AND dog` `"cat food"+milk` `"cat food"&"dog food"`
Either word in a topic	`OR` `or` `\|` (pipe)	`cat OR dog` `cat \| dog`
Topics that do not contain a specific word or phrase	`NOT` `not` `!` (exclamation point)	`NOT cat` `! dog`
Topics that contain one string and do not contain another	`^` (caret)	`cat ^ mouse`
A combination of search types	`( )` parentheses	`cat + (dog \| mouse)` `cat \| dog + (! mouse)`

Operations Manager i10.62

Administer > Event Processing > Topology-Based Event Correlation > Create Event Correlation Rules

Create Event Correlation Rules

In this task, you learn how to create a correlation rule. Correlation rules enable you to understand more quickly how to solve problems by distinguishing between events that are the symptoms of a problem and events that are causes.

Note You can also can manually relate events, assigning one event as a cause event and the other logically-related events as symptom events. For further information, see Relating Events Manually.

Manually-related events can also be used as the basis for creating new or enhancing existing correlation rules. For further information, see Creating Correlation Rules from Manually-Related Events.

To create a correlation rule:

Open the Correlation Rules manager:

Administration > Event Processing > Correlation > Topology-Based Event Correlation

Alternatively, click Topology-Based Event Correlation.
In the Correlation Rules pane, click the New Item button. The Create New Correlation Rule dialog box opens.

Note For information on button actions, see Correlation Rules User Interface.
Type a name, display name, and description for the new correlation rule.
Select a topology view to determine which configuration item types are available for inclusion in the new correlation rule. For more information about selecting topology views in correlation rules, see Select Topology Views.
Select Active to enable the rule during runtime. By default it is disabled.

Inactive rules are identified with diagonal black line through their icons in the Correlation Rules pane.
Optional. Specify a configuration time window. Select the check box and set the time period for the correlation rule you are creating. The range is from 0 to 9999 seconds. By default it is not enabled and the global value is used. 0 seconds also mean it is not enabled and the global setting is used.

Correlation Time Window sets the period of time in seconds that correlation rules wait for all required events to occur before reporting the cause event and emptying the correlation rule cache.

Cause and symptom events must arrive within that time frame in the correlation engine to be considered for correlation. A time window starts when a first cause or symptom event arrives that cannot be correlated with any other event.

Default value is 960 seconds (6 minutes). You can change this global value. For details, access Administration > Setup and Maintenance > Infrastructure Settings > Applications > Topology-Based Event Correlation Settings.
Select OK to start creating the correlation rule.
In the Finish Creating Correlation Rule pane, specify a valid the Rule Topology with cause and symptoms. For more information about selecting topology views in correlation rules, see Define the Rule Topology.
Click the Save button to save the correlation rule.

Send Help Center feedback