Established Member.. HHirt
Established Member..

NNMi 9 correlation question

Hello all,


We are running a version 9 of NNMi.


At a certain point I would like to create a new correlation to do the following :


When a incident InterfaceDown is coming I would like that the system keep this in the queue for 3-4min waiting for an NodeDown incident, if NodeDown comes, then only NodeDown is displayed/generated (InterfaceDown correlated under NodeDown).


If after 3-4 min no NodeDown incident comes, then the InterfacesDown are generated.


I tried with Dampening and Correlation Rules, but I wasn't able to create this.


Any help would be greatly appreciated :smileyhappy:


Thanks per advance

1 Reply
Dave Young Acclaimed Contributor.
Acclaimed Contributor.

Re: NNMi 9 correlation question

Its not possible to just correlate the interface down event under the parent event, neither can PairWise be used since this will close the events.


One way this can be achieved is to use a "Causal Rule" under the "Customer Correlation" configuration.  Causal rules can generate a new incident and then correlate one or more child events under it.  The trick to using them effectively is to use the "Open Key Incidents" view to see the incidents you want to manage.  However this does rely on generating a new event which in effect replaces the Node Down event in the display.


Here is how to set things up:


1) Create a new management incident that is configured to be a "key incident" and displays the Node Down infromation you wish to see.  Also specify the time period for the correlation.

2) Create a causal rule that specifies the above incident to be generated and is has a correlation nature of  "Root Cause"

3) Under the child incidents configure the Node Down incident to be a "required child" - so don't check the box, and check the two "Source" boxes.   You will need to specify a child filter attribute to ensure all the events are related to the same device.

4) Add the Interface down incident as a child filter but make it an optional child - so check the box.

5) add any other child incidents you may want to include in the correlation


  What the results should be is that if the node down incident comes in then the new Causal incident will be generated and the node down incident and any other child incidents within the window period will be correlated under it.  In the key incidents view you will only see the Causal incident.   However, if the Node Down incident does not come in then you will see the child incidents in the key incidents view ( if so configured ).


  You may want to tune this configuration to match your exact needs, but I hope it helps to achieve what you are after.


  All the best

MicroFocus Support
Viewed the Support tips? Search for "(NNMi) Support Tips" and order by Date to get the list
The views expressed in my contributions are my own and do not necessarily reflect the views and strategy of MicroFocus
If you find this or any post resolves your issue, please be sure to mark it as an accepted solution.
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.