Administer > Event Processing > Topology-Based Event Correlation > Cross-Domain Event Correlation

Cross-Domain Event Correlation

The Correlation Rules manager enables you to set up rules that correlate indicators for configuration item types in multiple and different domains, for example, database, storage, and web application. Cross-domain correlation connects a chain of rules that are defined in different domains. The correlation process can use the symptom of one rule as the cause of the next rule in the chain, or vice versa.

The link between correlation rules in different domains is the same indicator state assigned to the same configuration item type. In one rule, you can define an indicator state as a symptom for a specific configuration item type. In another rule for a different domain, you can define the same indicator state as a cause for the same configuration item type. If all the events occur in the different domains as expected and trigger correlation rules, the correlation process displays in the Event Browser only the cause event from the last rule in the event correlation chain.

Note Cross-domain correlation rules must share at least one identical combination of configuration item type and indicator state.

For example, if all the necessary correlation rules are defined for the database, storage, and web application domains, and the necessary indicator states are being monitored for a shared configuration item, the Correlation Rules manager can determine that a problem with physical disk utilization in the storage domain is the cause of the problem concerning the availability of the web server.

The Correlation Rules pane in the Correlation Rules manager incorporates a list of correlation rules containing symptoms or states that also feature in rules defined for a different domain. In cross-domain rules, indicator states configured as a symptom in one rule are also defined as a cause in a rule defined in another domain. You can choose whether to view rules that determine the symptom or the cause of an event and expand the item to see if the rule is part of a chain.