Define correlation rules

You can define correlation rules that correlate related events occurring in the same or different domains of the managed IT environment. Topology-Based Event Correlation (TBEC) is used to automatically identify and display the real cause of problems. Events that are only symptoms of the cause event can be filtered out using the Top Level Items filter, resulting in a clearer overview of the actual problems that need to be solved. Correlating events reduces the number of events displayed in the Event Browser and helps operators to locate the cause of the problems more quickly and efficiently.

You should think about which events of the ACME landscape are symptoms or causes of other events that you receive and check whether correlation rules can be defined.

For example, as illustrated in the following graphic, the ACME landscape has a dependency to an Oracle database. We assume here that the monitoring of such a database is realized through the Operations Smart Plug-In for Oracle (SPI for Oracle) and that an event is received when the database is no longer available. At the same time, one of the ACME policies detects a lost database connection as well, so it makes sense to define a correlation rule for these two related events. The following graphic shows such a rule, which defines that the event with the ETI Lost Database Connection Occurred is the symptom event, and the event with the ETI Database Server Status Down is the cause event.

Another example where defining a correlation rule would be appropriate is a scenario where a long job queue event is the cause of many Job Start Passedmessages.

Of course, you can define more elaborate TBEC rules for multiple symptoms and multiple causes.
For full details about correlation rules and mapping, see OMi Help.