I've spend quite some time trying to figure out how to create correlation circuit on OMi and the more I'm working on it, the more I'm confused. Can anybody provide some step by step instructions?
I.e. I have 2 type of alarms to be correlated and 1 to be a root cause and the second to be a symptom. Let's say:
1. Service ABC is down
2. And because of that, the "Process 123 is down"
Once "2" event comes after event "1" (let's say within 1 minute), supress event "2" since that's a symptom of problem, which is presented in event "1".
Events are forwarded from OML/OMW and on template level I already setup CMA, where created EventTypeIndicator="ServiceABC:Down" on 1st event and EventTypeIndicator="Process123:Down". So far, I'm able to see these events on OMi event bwowser, where ETI field is empty, but "ETIHint" field has these values "ServiceABC:Down" and "Process123:Down".
So my assumption is that I don't have such ETIs assigned to CI (or something like this), but I couldn't find the way to do so.
Can somebody give any recommendations/explanation, or ideally step-by-step instructions how to configure that correlation?
Note: I have fresh OMi installation, so no more effort rather than default config in terms of CI list is being made.
P.S. This thread has been moevd from Application Perf Mgmt (BAC / BSM) Support and News Forum to Systems Management (OpenView-OP Mgmt) Support and News Forum - Hp Forums moderator
Your events were not resolved to CI (or to the correct CI), thus the ETI hints you provided are not used.
Sounds like you are trying to create TBEC rule. for that you need:
T - topology: you need to have your events resolve to CIs, and to the correct CI (Computer, or Service, or Process). this will probably raise a question for you: how do i get CIs in RTSM to be used by OMi, but that's a whole new discussion...
E - events: your events need to have ETI, and hint is not enough...
C - correlation: you need to create a rule in OMi admin. that rule is going to need a RTSM View that has all the CITs you want to correlate.
Thanks for your response. This moved me one step forward my goal.
And yes, you are correct - I need to create TBEC rule. I tried to play around with correlation rules, but obviously (because of reasons you already mentioned, but it was hard to clearly understand for me at the beginning) I couldn't create it without preparing the whole bunch of things upfront.
At least based on my readings I've done in HP documentation, my ETI hints doesn't convert into ETI because I don't have topology defined. In other words, ETI hint doesn't know where to map that hint to.
So, if my statements above are somewhere close to truth, can you or anybody else (in high level) describe how can I make events to be resolved into CIs. For simplicity purposes, we can assume, my environment consist of 1 managed nodes which has CPU, disk, and network interface, runs one service and depends on one process (in terms of CI granularity).
You can start by doing TopoSync from OM into OMi and see the topology which got created for you (note that if you are using InfraSPI you need to change the default sync packages in OMi, but it is well documented).
Then you will send the events again and this time look at the Resolver Hints tab and see if your event resolved to the right CI. again, if you are using the latest InfraSPI, we prepared the policies in such a way that events will resolve to the right CI.
also, please note that by default we dont resolve events to Services and Processes, it is too granular for OMi.
By the way, in order to provide more information where I am:
- Synchronization between OM and OMi seems it's being done and on OMi event I can also see "Related CI" is corresponding to the correct node. Also, just in case I have launched opr-startTopologySync.sh script one more time and it have returned with success message. - When I look at the event in OMi, I can see following in General tab: Related CI, Source CI.
- Also, in "Resolver Hints" I can see values in following fields: ETI hint, Node hint, Core ID, Source CI hint, etc. By the way, ETI hint is called "Trunk:Failed", while I don't have any "Trunk" definitions in my CI configuration.
Another thing, which brought my attention:
- Matched hints condition count is 1 of 4 -> Where that number 4 comes from and why 1 have passed already?
- Status (below "Matched Hints Count): "Success: Classic Hint "Trunk: Omi@@my_node_name" resolved"" (While on OM template I have configured ETI to be "Trunk:Down"
Thanks in advance for your effort and sharing knowledge.
Glad to hear that TopoSync is working for you. please note that you are using the Static TopoSync (OMi pulls from OM) and not the dynamic (OM push into OMi). the latter is the best practice.
OMi uses many hints in order to find the best CI, in your case it looks like the hint from the TopoSync worked. The ETI hint failed since you probably created your own hint in the policy and I am not familiar with any ETI called "Trunk". If you want to use that, you need to create it in OMi Admin > Indicators (or Service Health Admin > Repositories > Indicators, it's the same). the ETI/HI need to be defined against the same CIT that your event got resolved to (probably Node or Computer).
It really sounds like you need to take training on OMi concepts... or learn it by the hard way: trial and error.
"Trunk" is my fake name I was playing around to make TBEC rule work based on 2 alarms, where 1 I called "Trunk", another "Customer" in OM policy's custom message attributes (CMA) named EventTypeIndicators. I agree in regards of training, but that's a pilot to see whether tool (OMi) would bring any valuen into our envirionment. And here we reached the point when I need to say, that I don't agree with HP philosophy - to pull money in anything, like training. I do agree organizaing advanced trainings or some other specialized, but all basics "HOW TOs", I believe should be available. The faster people get the idea of the tool, the more chances they will buy it. But that is slightly outside our topic, so let me work on your suggestions and see where it will get me to.
Asaf, I just took a quick look at my messages and seems like I'm even more confused: - Trunk:OMi in Status field (whole value is "Trunk:OMi@@<my_node_name>) is being taken from messsage attributes: one is Object, the other is Application name. - If I look at the messages, which I generated when I haven't added any CMA on OM policy level, I see that "ETI" and even "ETI Hint" fields are empty, but at the same time, "Matched hint Count" shows 1 of 2 and "Status" says": Success: Classic Hint "c:c@@<my_node_name>" resolved. I'm entirely confused, what really needs to be done in order to create TBEC rule. And what brings even more confusion, is that presales guy spend bunch of time repeating how easy and flowless TBEC is being created/maintained/administrated (at the same time didn't bother to show any hands-on example), so we started to believe this tool really may make a trick. But I still don't want to give up. Need to create at least one correlation rule to make it work and then, when rep will come back, start talking comparing apples to apples.