Administer > Event Processing > Topology-Based Event Correlation > Correlation Rule symptoms and causes

Correlation Rule symptoms and causes

In OMi, a correlation rule defines events as either causes or symptoms. If one or more of the events specified as symptoms occurs within a defined period of time, the triggered rule highlights the cause event in the Event Browser and creates a subgroup containing the symptom events.

Note The Event Browser uses icons to distinguish between events that are configured as the cause in a correlation rule and events that are configured as symptoms. For more information about icons in the Event Browser, see Icons and buttons.

Every rule that OMi uses to correlate events must have at least one symptom and one cause. Multiple cause indicators can be specified as long as they are specified for the same CI type. In the context of OMi correlation rules, symptoms and causes are defined as follows:

  • Symptom

    Symptoms in a correlation rule are events that occur as a result of another event. Symptom events are mapped to individual indicator states used to monitor the objects in your IT environment, for example, Database:Unavailable or Application response:Slow.

    You can map a symptom event to more than one indicator state, for example, Database:Down or unavailable. In this way, the event can contribute to more than one rule.

  • Cause

    Causes in a correlation rule are the events that are reporting problems and are the underlying reasons that other symptom events occur. In a correlation rule, cause events are mapped to an indicator state used to monitor the objects in your IT environment, for example: Network:Unreachable.

Note If multiple rules correlate the same symptoms at the same time but specify a different event as the cause, the event specified as the cause in the first rule triggered takes precedence and subsequent rules are ignored.

You can configure a chain of rules that correlate events across multiple domains. In cross-domain event correlation, an event can be configured as a symptom in one rule and as a cause in another rule. Similarly, an event configured as a cause in one correlation rule can be configured as a symptom in another rule. Rules that correlate events occurring in different domains require at least one common configuration item type and one indicator state. The common configuration item type and indicator state is the link between the rules defined for the different domains.

The contents of the panes are linked both conceptually and graphically. If you select a configuration item type in the Rule Topology pane, the Indicators Pane displays all indicators that could be assigned as cause or symptom for the current configuration item.

Send Help Center feedback