About event correlation and root-cause analysis
Events received from network devices are correlated with the network topology. This enables the system to determine root-cause events and provides the ability to switch between event data and network topology data.
Event correlation is the ability to analyze an event on one device and calculate the impact on each connected device in the network topology. By performing event correlation on each event received by the Tivoli Netcool/OMNIbus ObjectServer, the system is able to provide the following capabilities:
- Root-cause analysis
- Ability to switch between event data and network topology data
Root-cause analysis
Based on knowledge of the network topology, the system determines which devices are inaccessible due to other network failures. The system suppresses the events on these inaccessible devices and marks them in the Event Viewer as symptom events. The system marks the non-symptom events as root cause events.
Root cause events are differentiated from symptom events in the Event Viewer in the following ways:
- Root-cause events have a higher severity than symptom events. This ensures that root-cause events are given higher priority.
- The system marks root-cause events and symptom events using a field in the event record held in the ObjectServer. This provides the ability to identify the root cause event related to symptom events.
Ability to switch between event data and network topology data
This capability provides two approaches to network troubleshooting.
- You can initially identify network problems using events. Starting from an event in the Event Viewer, you can display a network map showing the affected device and the topology around that device.
- Alternatively, you can initially identify network problems using topology data. Starting from a network view or the Network Hop View containing a faulty device, you can display an Event Viewer showing all the events for that device.