How to easily reduce events in OMi using Stream Based Event Correlation

Ops_Guest
New Member.
1 2 365

This blog was written by a customer in the Financial industry

If you are using or have used  Operations Manager i (OMi), then you might be familiar with the Correlation Composer or ECS Designer functionality which was used to correlate events within OVO. Similarly you can use Stream-Based Event Correlation (SBEC) in the OMi world.

The following are the three different types of rules you can use to correlate events in OMi:

  • Repetition Rules
  • Combination Rules
  • Missing Recurrence Rules

To create a SBEC rule from OMi console, you can launch Stream-Based Event Correlation from Administration -> Event Processing -> Correlation -> Stream-Based Event Correlation. event processing.png

 

Once you launch this page you can click on the yellow star and you will see three options to create new SBEC rule. new repitition rule.png

 Today we will cover the Repetition Rule.

To create a Repetition Rule, click on New Repetition Rule and it will open up new window which will allow you to create new Repetition Rule.

Enter the name of Repetition Rule you want to create. (I would not check Activate rule at this point. Don't activate the rule until you are ready to test it.)

Display Name.png

 Click Next which will take you to next screen. Event filter.png

 

In this window you can create a new filter or choose existing filter you want to use for this rule.

Click on the ellipses to create new event filter. Select an event filter 2.png

Click on the yellow star to create new event filter. In OMi 10.12 and earlier, you will see two options—simple filter and advanced filter.

You can start with Simple Filter and then if needed you can convert it to Advanced Filter. (Note: Once you convert to Advanced Filter you cannot go back to simple filter.)

Once you click on New Simple Filter, it will open up the window which will allow you to create new filter.

Please enter a display name for the new filter you want to create.

 

Create new event filter.png

 

Here you can select what criteria you want to use to filter out events.

We selected severity Minor. The title equals Test Foo message and category Test. You can click on the Additional Event Properties tab which allows you to use other attributes of events to use as filter criteria. Once you selected criteria’s then click OK to finish.

You can test the filter by clicking magnify.

Once the event filter is created, you can then select other criteria of the SBEC rule.

 

Repititions.png

 

You can select number of events within specific time window and how you want to execute. Options include “first time’ or “every time” and how to handle subsequent events within remaining or sliding time window.

Then click next. actions.png

 Now you can configure the action. You can edit attributes of same event and create a new event which you want to display in OMi event browser. Once you decide then you can click on Edit attributes which allows you to use existing attributes of event or replace it with some other value. Create new event 2.png

 

Once you finish this, click on OK. Then from previous window click on Finish.

Now new SBEC repetition rule is created and ready to use.

You can click on the blue circle to activate the rule.  Now you can see the magic of repetition SBEC rule!

Instead of seeing many events, you will see one single event.

 

I hope this blog has helped you understand how to use this functionality for yourself. 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

2 Comments
MukeshPatel
Not applicable

Very nicely explained.

Valued Contributor.. MJ_Scoggins Valued Contributor..
Valued Contributor..

Great how to for SBEC! Does anyone know what exactly is meant by "handle subsequent events within remaining or sliding time window"? 

The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.