Configuring event pattern processing

Configure how patterns are derived from related events using this example-driven wizard panel.

To configure event pattern processing, you must specify Historical Event Database columns to use for settings such as event type, event identity, and resource, or accept the columns specified as default. If you want to use custom columns, then you must first configure the Impact Event Reader to read these custom fields, as described in the following topic: Netcool®/Impact Knowledge Center: OMNIbus event reader service.

An event pattern is a set of events that typically occur in sequence on a network resource. For example, on a London router LON-ROUTER-1, the following sequence of events might frequently occur: FAN-FAILURE, POWER-SUPPLY-FAILURE, DEVICE-FAILURE, indicating that the router fan needs to be changed. Using the related event group feature, Event Analytics will discover this sequence of events as a related event group on LON-ROUTER-1.
Using the event pattern feature, Event Analytics can then detect this related event group on any network resource. In the example above, the related event group FAN-FAILURE, POWER®-SUPPLY-FAILURE, DEVICE-FAILURE detected on the London router LON-ROUTER-1 can be stored as a pattern and that pattern can be detected on any other network resource, for example, on a router in Dallas, DAL-ROUTER-5.

  1. Select the appropriate Historical Event Database column(s) for the following Global settings:
    Default event type
    An event type is a category of event, for example: FAN-FAILURE, POWER-SUPPLY-FAILURE and DEVICE-FAILURE are event types. By default event type information is stored in the following Historical Event Database column: ALERTGROUP. If you have another set of events that you categorize in a different way, then you can specify additional event type columns in section 2 below.
    Default event identity
    The event identity uniquely identifies an event on a specific network resource. By default the event identity is stored in the following Historical Event Database column: IDENTIFIER.
    Resource
    A resource identifies a network resource on which events occur. In the example, LON-ROUTER-1 and DAL-ROUTER-5 are examples of resources on which events occur. By default this resource information is stored in the following Historical Event Database column: NODE.
  2. If you have another set of events that you categorize in a different way, you can add them as Additional event types.
    1. Select the check box to enable Additional event types.
    2. Click Add new. Add a row for each distinct set of events.
    3. Specify the filters and fields listed below for each set of events. Event Analytics uses these settings to determine event patterns for a set of events. Filters are applied from top to bottom, in the order that they appear in the table. You can change the order by using the controls at the end of the row.
      version 1.6.0.3 iconType name
      Specify the type name. Use a name that is easily understandable as it will be used later to identify this event type when associating specific event types with an event analytics configuration.
      Note: If at a later stage you are editing this page, and the event type has been associated with one or more event analytics configurations, then the Type name field is read-only.
      Database filter
      Specify the filter that matches this set of historical events in the Historical Event Database.
      ObjectServer filter
      Specify the filter that matches the corresponding set of live events in the ObjectServer. The ObjectServer filter should be semantically identical to the Database filter, except that you should specify ObjectServer column syntax for the columns.
      Event type field
      An event type is a category of event, for example: FAN-FAILURE, POWER-SUPPLY-FAILURE, and DEVICE-FAILURE are event types. For this set of events, specify the Historical Event Database column that stores event type information.
      Event identity field(s)
      The event identity uniquely identifies an event on a specific network resource. For this set of events, specify the Historical Event Database column or columns that stores event identity information.
    Note: You can delete any of the additional event types by clicking the trash can delete icon. If the type is already being used in one or more analytics configurations then deleting the type will remove it from those configurations. To ensure your analytics results are fully synchronized you should rerun the affected analytics configurations.