Setting the node field based on probable cause

Learn how to set the node field based on probable cause.

Event Manager groups events by temporal, scope-based, or topology-based associations. Synthetic parent events are created. By default, the node field of the synthetic parent event is set to the unique group identifier for the group. Also, by default, the summary field of the synthetic parent event is set to include the summary field of the child event with the highest probable cause score. It might be desirable to align the node field of the synthetic parent event to match the node field of the child event with the highest probable cause score.

Included within IBM® Tivoli® Netcool®/Impact is a policy and service that causes the node field of synthetic parent events to track to the node field of the child event with the highest probable cause score. The summary field of the synthetic parent event is compared to that of the child events. The node field of the synthetic parent event is reset to match that of the child event, which has the same summary field value. If more than one child event has the same summary field as the parent event, the child event that has the highest probable cause score is automatically selected.

The Netcool/Impact project, EventManagementAnalytics, has the relevant policy and service.

Steps to set the node field

1. Locate the policy by selecting Automations > Netcool Impact > Policies > SetNodeOnProbableCause.

2. Edit the policy. The first section of the policy contains the following user-modifiable parameters.
  • DatasourceName: By default, your datasource name is defaultobjectserver. Only modify this property if you are making a copy of the policy to run against a different ObjectServer datasource.
  • ProcessingDelay: It takes some time for events to arrive into the system and for probable cause analysis to run. A processing delay is introduced to allow this to happen first. The default processing delay is 60 seconds.

3. Locate the corresponding service by selecting Automations > Netcool Impact > Services > SetNodeOnProbableCause. This policy activator service is configured to run every 13 seconds.

4. Edit the service. The service can be edited and configured to start automatically when the Netcool/Impact server starts. Click Start Service (green play button) to start this service.