Condition Correlation

Transcription

1 Condition Correlation User Guide Document 5175

2 Notice This documentation (the "Documentation") and related computer software program (the "Software") (hereinafter collectively referred to as the "Product") is for the end user's informational purposes only and is subject to change or withdrawal by CA at any time. This Product may not be copied, transferred, reproduced, disclosed, modified or duplicated, in whole or in part, without the prior written consent of CA. This Product is confidential and proprietary information of CA and protected by the copyright laws of the United States and international treaties. Notwithstanding the foregoing, licensed users may print a reasonable number of copies of the Documentation for their own internal use, and may make one copy of the Software as reasonably required for back-up and disaster recovery purposes, provided that all CA copyright notices and legends are affixed to each reproduced copy. Only authorized employees, consultants, or agents of the user who are bound by the provisions of the license for the Software are permitted to have access to such copies. The right to print copies of the Documentation and to make a copy of the Software is limited to the period during which the license for the Product remains in full force and effect. Should the license terminate for any reason, it shall be the user's responsibility to certify in writing to CA that all copies and partial copies of the Product have been returned to CA or destroyed. EXCEPT AS OTHERWISE STATED IN THE APPLICABLE LICENSE AGREEMENT, TO THE EXTENT PERMITTED BY APPLICABLE LAW, CA PROVIDES THIS PRODUCT "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NONINFRINGEMENT. IN NO EVENT WILL CA BE LIABLE TO THE END USER OR ANY THIRD PARTY FOR ANY LOSS OR DAMAGE, DIRECT OR INDIRECT, FROM THE USE OF THIS PRODUCT, INCLUDING WITHOUT LIMITATION, LOST PROFITS, BUSINESS INTERRUPTION, GOODWILL, OR LOST DATA, EVEN IF CA IS EXPRESSLY ADVISED OF SUCH LOSS OR DAMAGE. The use of this Product and any product referenced in the Documentation is governed by the end user's applicable license agreement. The manufacturer of this Product is CA. This Product is provided with "Restricted Rights." Use, duplication or disclosure by the United States Government is subject to the restrictions set forth in FAR Sections , , and (c)(1) - (2) and DFARS Section (c)(1)(ii), as applicable, or their successors. All trademarks, trade names, service marks, and logos referenced herein belong to their respective companies. Copyright 2006 CA. All rights reserved.

3 Contents Preface Audience Organization Text Conventions SPECTRUM Documentation Document Feedback Chapter 1: Introduction Overview Condition Correlation Components Conditions Rules Policies Domains Getting Started Open Condition Correlation Editor Condition Correlation Editor Window Create a Condition Correlation Domain Chapter 2: Creating and Managing Conditions Create a Condition Edit a Condition Delete a Condition Chapter 3: Creating and Managing Rules Create a Rule Edit a Rule Delete a Rule Chapter 4: Creating and Managing Policies Create a Policy Edit a Policy Delete a Policy

4 Chapter 5: Creating and Managing Domains Create a Domain Edit a Domain Delete a Domain Chapter 6: Condition Correlation Examples Power Outage WAN Link Failure Index Condition Correlation User Guide

5 Preface Content Audience on page 5 Organization on page 5 Text Conventions on page 6 SPECTRUM Documentation on page 6 Document Feedback on page 6 Audience This manual describes how to use the Condition Correlation Editor, Condition Correlation s application utility, to create and manage all Condition Correlation components and implement a fault-correlation strategy to manage infrastructure alarms. It is intended for network management personnel who have a working knowledge of SPECTRUM event/alarm processing concepts, capabilities, and terminology. Organization This document is organized as follows: Chapter 1, Introduction, on page 7 provides an overview of Condition Correlation concepts, describes how to access the Condition Correlation Editor, and correlation Domain creation process. Chapter 2, Creating and Managing Conditions, on page 13 describes how to work with correlation Conditions. Chapter 3, Creating and Managing Rules, on page 17 describes how to work with correlation Rules. Chapter 4, Creating and Managing Policies, on page 21 describes how to work with correlation Policies. Chapter 5, Creating and Managing Domains, on page 25 describes how to work with correlation Domains. 5

6 Preface Chapter 6, Condition Correlation Examples, on page 29 describes how Condition Correlation can be used to manage alarms resulting from two typical infrastructure faults. Text Conventions The following text conventions are used in this document where applicable: Element Convention Used Example Variables (The user supplies a value for the variable.) The directory where you installed SPECTRUM or OneClick (The user supplies a value for the variable.) Linus, Solaris, and Windows directory paths Courier and Italic in angle brackets (<>) <$SPECROOT> Unless otherwise noted, directory paths are common to all operating systems, with the exception that slashes (/) should be used in Linux and Solaris paths, and backslashes (\) should be used in Windows paths. Type the following: DISPLAY=<workstation name>:0.0 export display Navigate to: <$SPECROOT>/app-defaults <$SPECROOT>/app-defaults on Linux and Solaris is equivalent to <$SPECROOT>\app-defaults on Windows. On-screen text Courier The following line displays: path= /audit User-typed text Courier Bold Type the following path name: C:\ABC\lib\db Cross-references Underlined and hypertext-blue See Document Feedback. References to SPECTRUM documents (title and number) Italic OneClick Console User Guide (5130) SPECTRUM Documentation The SPECTRUM documentation set is available online at: Use this site to download the latest documentation updates and additions. To log on to the documentation site, you must supply your contract number and license number. Document Feedback Please send feedback regarding SPECTRUM documents to the following address: spectrum-docs@aprisma.com Thank you for helping us improve our documentation. 6 Condition Correlation User Guide

7 Chapter 1: Introduction Overview An integral member of SPECTRUM s family of root-cause analysis and service management technologies, Condition Correlation enables you to set up a system to determine which alarm is the root-cause alarm among a barrage of seemingly unrelated alarms from a heterogeneous group of managed infrastructure resources (models). You use Condition Correlation to define the criteria that specifies the causal problem event that precipitates a specific set of the symptomatic problem events. You apply the criteria to the resources included in a Container model, and if the criteria are met SPECTRUM generates an alarm for the root-cause event, suppresses the alarms that are symptomatic of the root-cause alarm, and indicates the causal/symptomatic relationship in the alarm panel in OneClick. Using Condition Correlation to help manage trouble-prone segments of the infrastructure is beneficial in the following ways: It enables you to correctly and efficiently respond to the real problem rather than symptomatic problems. It enables you to confirm and track problem trends and interdependencies. It enables you to respond quickly to changes in the infrastructure by letting you manage multiple Condition Correlation implementations from a single landscape. Condition Correlation Components When you work with Condition Correlation, you construct a system comprising components that define fault indicators, how faults are associated, and the resources evaluated by the system. This section describes these components: Conditions Rules Policies Domains 7

8 Chapter 1: Introduction As you review the component descriptions, we recommend that you also examine the pre-defined (CA-authored) components included with the Condition Correlation application to gain a better understanding of what they represent and their parts. See Open Condition Correlation Editor on page 9 for more information. Conditions A Condition is the basic building block of the correlation system. A Condition, like a SPECTRUM alarm, is a transitory occurrence (e.g., state change) on a resource. Like an alarm, a Condition is always initiated by a set event and can be cleared by a clear event. When you define a Condition, you identify the set and clear event types. You can also define Conditions parameters used to establish correlation criteria when you create correlation Rules. Note: A correlation Condition has no relationship whatsoever with the condition attribute for a SPECTRUM model. See Creating and Managing Conditions on page 13 for information on working with Conditions. Conditions and SPECTRUM Alarms Although it is not required, it is advantageous in a number of ways to define Conditions that correspond to SPECTRUM alarms. First, if a Condition s set event is the same as an alarm s the Condition instance instantiated when the alarm is generated and the alarm are linked within the correlation system. Second, this link allows Condition Correlation to hide symptomatic alarms from the main alarm list in OneClick and relate symptomatic alarms to root-cause alarms. The symptomatic alarms, however, are listed in the Symptoms list of the root-cause alarm under the Impact tab. Rules A Rule defines the relationship between two or more Conditions when specific criteria are met. You can define a Rule to stipulate that one Condition is a symptom of or the cause of another. For example, you could associate a symptomatic SPM test threshold violation Condition to a root-cause port LinkDown Condition and apply this Rule (in a Policy) to a set of SPM test and port models (in a Domain). Additionally, you can create a Rule to indicate that one or more Conditions imply that another exists. See Creating and Managing Rules on page 17 for information on working with Rules. Rule Patterns Rules can be expressed by any of the following patterns: Condition X or a set of Conditions is caused by Condition Z Condition X or a set of Conditions implies Condition Z Condition X or a set of Conditions is the implied cause of Condition Z Condition Correlation also lets you construct more granular Rule patterns using additional rule criteria that must be met before a correlation is established between two Conditions. The criteria can be specified in terms of comparison between parameters for one Condition and parameters of another or in terms of specific values. 8 Condition Correlation User Guide

9 Getting Started For example, an instance of a LinkDown Condition on a port model could be caused by an instance of a BoardPulled Condition on a board if the slot number of the port is equal to the slot number of the board and both the port and the board are from the same device. Policies A Policy is simply a set of one or more Rules. You can group any number of Rules in a Policy, and you can apply one or more Policies to any number of resource groups (in a Domain). Using Policies simplifies the implementation of Rules for multiple Domains. When you add or remove Rules from a Policy, all implementations of the Policy are updated as well. See Creating and Managing Policies on page 21 for information on working with Policies. Domains A Domain is a group of resources collectively assessed by Condition Correlation based on the Rules in the Policies applied to it. A Domain can include any number of diverse models of different model types, and it can have any number of Policies applied to it. A Domain is a SPECTRUM Container model, and thus when you specify the resources in a Domain you are explicitly defining what you want and what you do not want evaluated by the Policy or Policies applied to it. Keep in mind that you must explicitly add resources on a per-resource basis to a Domain. In other words, if you want to add a device model and a number of port models for the device, you must add each particular model to the Domain. Adding the device model does not add its component models to the Domain. Also keep in mind that SPECTRUM performance might be degraded because of the volume of correlation processing required for very large Domains. See Creating and Managing Domains on page 25 for information on working with Domains. Getting Started This section describes how to access the Condition Correlation Editor, the utility with which you create and manage your correlation systems, and its functional parts. It also provides an overview of the process involved in creating a correlation system and describes how to monitor Correlation Domain containers in OneClick. Open Condition Correlation Editor The Condition Correlation Editor lets you configure all Condition Correlation component settings. You must have OneClick administrative privileges to access Condition Correlation Editor. To open the Condition Correlation Editor 1. Open OneClick. 2. Select Tools, Utilities, Condition Correlation Editor. The Condition Correlation Editor window (Figure 1-1) opens. By default, it displays the Conditions tab list and any parameters defined for the selected Condition. Condition Correlation User Guide 9

10 Chapter 1: Introduction Figure 1-1: Condition Correlation Editor Condition Correlation Editor Window The Condition Correlation Editor window lets you create and manage all correlation system components. It also lists and provides access to all pre-defined (CA-authored) and user-defined components. The window includes the following parts: Conditions tab Invokes a list of CA-authored and user-authored Conditions and a list of parameters (Parameters tab) for the selected Condition. Not all Conditions include parameters. Rules tab Invokes a list of CA-authored and user-authored Rules and the Rule s correlation criteria (Rule Criteria tab) for the selected Rule. Policies tab Invokes a list of CA-authored and user-authored Policies and a list of Rules (Rules tab) included in the selected Policy. 10 Condition Correlation User Guide

11 Create a Condition Correlation Domain Domains tab Invokes a list of CA-authored and user-authored Domains, a list of Policies (Policies tab) applied to the selected Domain, and a list of resources (Resources tab) included in the Domain. Filter field Specifies the Conditions, Rules, Policies, or Domains list entry you want to display. Create button Invokes the Create Correlation Condition, Rule, Policy, or Domain window. Edit button Invokes the Edit Correlation Condition, Rule, Policy, or Domain window. Delete button Deletes the selected Condition, Rule, Policy, or Domain. Create a Condition Correlation Domain Deploying a correlation system to a particular group of managed infrastructure resources is synonymous with creating a correlation Domain that encompasses those resources and that has a correlation Policy applied to it. Once the Domain has been created on a landscape, the correlation system is in effect. This section provides step-by-step instructions on how to construct the components required to implement the Domain. You are not required to follow the instruction s exact order. What is important is that you make sure that a Domain has at least one Policy applied to it and that the Policy includes at least one Rule and that the Rule criteria is logically appropriate for the Conditions it evaluates for correlative association. Important! Make every attempt to induce the problem situation you want to manage to test the viability of the correlation system before you deploy the system in a mission-critical environment. To create a correlation Domain 1. Create a Domain and add the resources you want included in the Domain. In a later step, you will apply one or more correlation Policies to the Domain. Once you have created a Domain, you can add resources to it and remove resources from it at any time. 2. Create one or more Conditions you want evaluated by correlation Rule criteria. If, however, you want to use available Conditions only, skip this step. 3. Create the Rule or Rules that establish root-cause Condition and symptomatic Condition associations if criteria specified by the Rules are met. If, however, you want to use available Rules only (i.e., Rules that specify pre-defined Conditions), skip this step. A Rule evaluates two or more Conditions. If Rule criteria are met, Condition Correlation identifies one Condition as the root-cause Condition and the other Conditions as symptomatic of the root-cause Condition. Once you have created a Rule, you can modify its criteria or the Conditions it evaluates at any time. Condition Correlation User Guide 11

12 Chapter 1: Introduction 4. Create the Policy or Policies that contain the correlation Rules you want to associate with the Domain. If, however, you want to use available Policies only, skip this step. You can add Rules to or remove Rules from a Policy at any time. 5. Apply one or more Policies to the Domain. At this point the Condition Correlation process is in effect for the resources included in the Domain. The Domain is modeled as a Correlation Domain container in OneClick. Figure 1-2 shows an example Domain container. Figure 1-2: Correlation Domain Icon in OneClick Explorer 12 Condition Correlation User Guide

13 Chapter 2: Creating and Managing Conditions You can use pre-defined Conditions provided with Condition Correlation to set up correlation Rules, or you can create your own. This section describes how to create new Conditions, create new versions of other Conditions, and edit Condition settings. Create a Condition You can create a new Condition using either of the following methods: Create a new Condition Create a modified version of a existing Condition To create a Condition 1. Click the Conditions tab in the Condition Correlation Editor window. The Condition Correlation Editor window displays a list of CA-authored and user-created Conditions. 2. Choose one the following options: Click Create to create a new Condition. The Create Correlation Condition window (Figure 2-1) opens. It does not include default settings. 13

14 Chapter 2: Creating and Managing Conditions Figure 2-1: Create Correlation Condition Select the Condition from which you want to create a new Condition, and then click Edit. The Edit Correlation Condition window (Figure 2-2) opens. It includes the property settings for the Condition you selected. Figure 2-2: Edit Correlation Condition 3. Provide or edit values for the following Condition properties: Condition Name Defines the Condition name. Set Event Code Identifies the SPECTRUM event code associated with the Condition. Clear Event Code (Optional) Identifies the SPECTRUM clear event code associated with the Condition. 4. (Optional, for advanced correlation only) Specify one or more parameters that can be used to determine if a correlation should be made between instances of the new Condition. A parameter can be any event variable data or any model attribute of the model associated with the Condition. You can create new parameters, or you can create modified versions of existing parameters. 14 Condition Correlation User Guide

15 Create a Condition Configure parameters using one of the following methods: To create a new parameter, click Create next to the Parameters box. The Create Correlation Parameter window (Figure 2-3) opens. Figure 2-3: Create Correlation Parameter To modify an existing parameter or create a new parameter from an existing parameter, select the parameter you want to modify, and then click Edit next to the Parameters box. The Edit Correlation Parameter window (Figure 2-4) opens. Figure 2-4: Edit Correlation Parameter Provide or edit values for the following parameter properties: Parameter Name Defines the Parameter name. Provide a name that indicates the parameter type. Parameter Type Specifies the type of parameter. Choose one of the following options: Model Attribute Specifies a model attribute parameter type. Var Bind Specifies a varbind parameter type. Predefined Specifies either a Model, Model Type, or Device Model. Parameter ID Defines the ID number for the type of parameter indicated in Parameter Type. If you chose Model Attribute, click Attribute to open the Attribute Selector window and select the Model Attribute ID. If you chose Var Bind, enter the varbind variable number associated with the trap for the model associated with the Condition. Condition Correlation User Guide 15

16 Chapter 2: Creating and Managing Conditions If you chose Predefined, select from the adjacent drop-down list either Model to enter the Model_Handle associated with the Condition (Attribute ID 0x129fa), Model Type to enter the Model_Type_Handle of the model associated with the Condition (Attribute ID 0x10001), or Device Model to enter Device_Mdl_Handle of the model associated with the Condition (Attribute ID 0x10069). Click Create in the Create Correlation Parameter window or Edit Correlation Parameter window to add the new parameter, or click OK to save modifications to an existing parameter in the Edit Correlation Parameter window. 5. Click Create in the Create Correlation Condition window or the Edit Correlation Condition window to save the new Condition. The Condition Correlation Editor saves the new Condition to the Conditions tab list. The Condition Author property identifies you as the Condition s author. Edit a Condition You can edit properties for all CA-authored and user-authored Conditions. To edit a Condition 1. Click the Conditions tab in the Condition Correlation Editor window. The Condition Correlation Editor window displays a list of Conditions. 2. Select the Condition you want to edit, and then click Edit. The Edit Correlation Condition window opens. 3. Edit Condition properties, which are described in Create a Condition on page 13, and then click OK. Condition Correlation Editor saves your changes. Delete a Condition You can permanently delete user-authored Conditions, but you cannot permanently delete CA-authored Conditions. If you or another user has edited and assumed ownership of a CA-authored Condition, you can delete it only temporarily because Condition Correlation Editor restores the original CA-authored Condition with its default settings at the next OneClick server restart. To delete a Condition 1. Click the Conditions tab in the Condition Correlation Editor window. The Condition Correlation Editor window displays a list of CA-authored and user-authored Conditions. 2. Select the user-authored Condition you want to delete, and then click Delete. Condition Correlation removes the Condition from the Conditions tab list. 16 Condition Correlation User Guide

17 Chapter 3: Creating and Managing Rules You can use pre-defined Rules to set up Correlation Policies, or you can create your own. This section describes how to create new Rules, create new versions of existing Rules, and edit Rule settings. Create a Rule You can create a new Rule using either of the following methods: Create a new Rule Create a modified version of a existing Rule To create a rule 1. Click the Rules tab in the Condition Correlation Editor window. The Condition Correlation Editor window displays a list of CA-authored and user-authored Rules. 2. Choose one of the following options: Click Create to create a new Rule. The Create Correlation Rule window (Figure 3-1) opens. It does not include default settings. Figure 3-1: Create Correlation Rule 17

18 Chapter 3: Creating and Managing Rules Select the Rule from which you want to create a new Rule, and then click Edit. The Edit Correlation Rule window (Figure 3-2) opens. It includes the property settings for the Rule you selected. Figure 3-2: Edit Correlation Rule 3. Provide or edit values for the following Rule properties: Rule Name Defines the name of the Rule. Symptom Condition(s) Specifies the Conditions that are symptoms of, or resulting from, another Condition. You can select one or more Conditions. For each symptomatic Condition, you can use the set command to specify whether or not you want it to belong to a correlation Domain: Exists The Condition is in the correlation Domain. Not Exists The Condition is not in the correlation Domain. This enables you to create rules that can only be satisfied if the Condition does not exist in the Correlation Domain. Counts The Condition is in the correlation Domain, and it allows totals/limits/range comparisons (via the Advanced Rule Criteria section of the Create Correlation Rule window). This enables you to create Rules that are satisfied only if a certain number of a particular Condition exists, reaches a limit, or is in a user-defined range. Relationship Specifies the relationship between symptomatic Conditions and the root cause Condition. You can choose one of the following relationships: Caused By The alarm associated with the root cause Condition caused the alarms for the associated symptomatic Conditions. When the Rule is met, OneClick suppresses the alarms for symptomatic Conditions and lists them as symptoms under the Alarms view Impact tab in OneClick. 18 Condition Correlation User Guide

19 Edit a Rule Implies The symptomatic Conditions suggest the existence of another Condition that may be unknown to the management system. When the Rule is satisfied, the set event of the implied Condition is processed on the target model. Though, this may raise an alarm on the target model, OneClick will not suppress the alarms for symptomatic Conditions. Implied Cause This rule incorporates the logic of the Caused By and Implies Rules. The symptomatic Conditions are indicative of another Condition. The set event of this implied Condition is processed on the target model. If this event raises an alarm on the target model, OneClick will suppress the alarms associated with the symptomatic Conditions and will list the suppressed alarms as symptoms of the root cause alarm under the Impact tab in OneClick. If you choose Implies or Implied Cause, the Root Cause Target selection box appears on the Correlation Rule window. It lets you specify whether the alarm should be generated on the correlation Domain with which the Rule is associated or on one of the symptomatic Conditions. Root Cause Condition Specifies the single Condition that caused or was the implied cause of the symptomatic Conditions. You can select only one root cause Condition for a Rule. 4. (Optional) Click the Show Advanced button to open the rule criteria workspace. Use advanced rule criteria when you have specified Condition parameters and you want to establish correlation criteria based on parameter values. 5. Click Create in the Create Correlation Rule window or the Edit Correlation Rule window to save the new Condition. The Condition Correlation Editor saves the new Rule to the Rule tab list. The Rule Author property identifies you as the Rule s author. Edit a Rule You can edit properties for all CA-authored and user-authored Rules. To edit a Rule 1. Click the Rule tab in the Condition Correlation Editor window. The Condition Correlation Editor window displays a list of CA-authored and user-authored Rules. 2. Select the Rule you want to edit, and then click Edit. The Edit Correlation Rule window opens. 3. Edit Rule properties, which are described in Create a Rule on page 17, and then click OK. Condition Correlation Editor saves your changes with your user name identified in the Rule Author field. Condition Correlation User Guide 19

20 Chapter 3: Creating and Managing Rules Delete a Rule You can permanently delete user-authored Rules, but you cannot permanently delete CA-authored Rules. If you or another user has edited and assumed ownership of a CA-authored Rule, you can delete it only temporarily because Condition Correlation Editor restores the original CA-authored Rule with its default settings at the next OneClick server restart. To delete a Rule 1. Click the Rules tab in the Condition Correlation Editor window. The Condition Correlation Editor window displays a list of CA-authored and user-authored Rules. 2. Select the Rule you want to delete, and then click Delete. Condition Correlation removes the Rule from the Rules tab list. 20 Condition Correlation User Guide

21 Chapter 4: Creating and Managing Policies You can save one or more correlation Rules to a correlation Policy, which you can then apply to any correlation Domain. You can use pre-defined Policies, or you can create your own. This section describes how to create new Policies, create new versions of existing Policies, and edit Policy settings. Create a Policy You can create a new Policy using either of the following methods: Create a new Policy Create a modified version of a existing Policy To create a Policy 1. Click the Policies tab in the Condition Correlation Editor window. The Condition Correlation Editor window displays a list of CA-authored and user-author Policies. 2. Choose one of the following options: Click Create to create a new Policy. The Create Correlation Policy window (Figure 4-1) opens. It does not include default values. Figure 4-1: Create Correlation Policy 21

22 Chapter 4: Creating and Managing Policies Select the Policy from which you want to create a new Policy, and then click Edit. The Edit Correlation Policy window (Figure 4-2) opens. It includes the property settings for the Policy you selected. Figure 4-2: Edit Correlation Policy 3. Provide values for or edit the following Policy properties: Policy Name Defines the Policy name. Policy Rules Includes the rules for the Policy. Use the Arrow buttons to add rules from the Available Rules box to the Policy Rules box and to remove rules from the Policy Rules box. Click Create in the Create Correlation Policy window or the Edit Correlation Policy window to save the new Policy. The Condition Correlation Editor saves the new Policy to the Policies tab list. The Policy Author property identifies you as the Policy s author. Edit a Policy You can edit properties for all CA-authored and user-authored Policies. To edit a Policy 1. Click the Policies tab in the Condition Correlation Editor window. The Condition Correlation Editor window displays a list of policies. 2. Select the Policy you want to modify, and then click Edit. The Edit Correlation Policy window opens. 3. Edit Policy properties, which are described in Create a Policy on page 21, and then click OK. Condition Correlation Editor saves your changes with your user name identified in the Policy s Author field. 22 Condition Correlation User Guide

23 Delete a Policy Delete a Policy You can permanently delete user-authored Policies, but you cannot permanently delete CA-authored Policies. If you or another user has edited and assumed ownership of a CA-authored Policy, you can delete it only temporarily because Condition Correlation Editor restores the original CA-authored Policy with its default settings at the next OneClick server restart. To delete a Policy 1. Click the Policies tab in the Condition Correlation Editor window. The Condition Correlation Editor window displays a list of policies. 2. Select the Policy you want to delete, and then click Delete. Condition Correlation Editor removes the Policy from the Policies tab list. Condition Correlation User Guide 23

24 Chapter 4: Creating and Managing Policies 24 Condition Correlation User Guide

25 Chapter 5: Creating and Managing Domains You can create as many different correlation Domains containing as many different correlation Policies for as many different types of managed resources as you require to manage alarm events. This section describes how to create new Domains, create new versions of existing Domains, and edit Domain settings. Create a Domain You can create a new Domain using either of the following methods: Create a new Domain Create a modified version of a existing Domain To create a Domain 1. Click the Domains tab in the Condition Correlation Editor window. The Condition Correlation Editor window displays a list of any Domains that users have created. Condition Correlation does not include default Domains. 2. Choose one of the following options: Click Create to create a new Domain. The Create Correlation Domain window (Figure 5-1) opens. Figure 5-1: Create Correlation Domain 25

26 Chapter 5: Creating and Managing Domains Select the Domain from which you want to create a new Domain, and then click Edit. If no Domains are listed (have been created) you must create a Domain. The Edit Correlation Domain window (Figure 5-2) opens. Figure 5-2: Edit Correlation Domain 3. Provide or edit values for the following Domain properties: Domain Name Defines the domain name. Landscape Defines the landscape for the Domain. Important: If you plan to add resources to the Domain from multiple landscapes, you must create the Domain on the Main Location Server. 4. Add one or more Policies from the Available Policies box to the Domain Policies box. If you are creating another version of an existing Domain, remove Policies as required from the Domain Policies box. 5. Add or remove resources from the Domain. If you are creating a new Domain, add resources to it. If you are creating a new Domain from an existing one, you can add and remove resources as required. To add resources: a. Click the Resources tab. The Locate Resources window opens. It lets you search for the resources you want to add to the Domain. b. Select the resources you want to add to the Domain from the returned search list, click Add Selected to Correlation Domain, and then click Close. The resources you added appear under the Resources tab in Create Correlation Domain or Edit Correlation Domain window. Note: You can also add resources to a Domain by using the OneClick Locater to find resources and add them to the Domain using the Add To command. See the OneClick Console User Guide (5130) for more information about using the OneClick Locater. 26 Condition Correlation User Guide

27 Edit a Domain To remove resources from a Domain from which you are creating a new Domain: a. Select the resources you want to remove from the Resources tab list in the Edit Correlation Domain window b. Click Remove, and then click Close. The resources are removed from the Resources tab list. 6. Click Create in the Create Correlation Domain window or the Edit Correlation Domain window. The Condition Correlation Editor saves the new Domain to the Domain tab list. The Domain Author property identifies you as the Domain s author. Edit a Domain You can edit all Domain properties. To edit a Domain 1. Click the Domains tab in the Condition Correlation Editor window. The Condition Correlation Editor window displays a list of Domains. 2. Select the Domain you want to edit, and then click Edit. The Edit Correlation Domain window opens. 3. Edit Domain properties, as described in Create a Domain on page 25, and then click OK. Condition Correlation Editor saves your changes. Delete a Domain You can delete any Domain created by any user. To delete a Domain 1. Click the Domain tab in the Condition Correlation Editor window. The Condition Correlation Editor window displays a list of Domains. 2. Select the Domain you want to delete, and then click Delete. Condition Correlation Editor removes the Domain from the Domains tab list. Condition Correlation User Guide 27

28 Chapter 5: Creating and Managing Domains 28 Condition Correlation User Guide

29 Chapter 6: Condition Correlation Examples The examples included in this chapter illustrate how Condition Correlation can be used to manage alarms in two different infrastructure fault scenarios. Note: All fictitious instances of alarms and Condition Correlation components referenced in the examples are enclosed in double quotation marks ( ). References to existing events and alarms defined in SPECTRUM are not. Power Outage This example describes one way that Condition Correlation can be used to pinpoint the root-cause alarm and symptomatic alarms among a barrage of alarms SPECTRUM generates for different resources as a result of an infrastructure power outage. Scenario When a power outage occurs, managed UPS systems generate traps indicating they have switched over to backup battery power. When backup battery power wanes, the systems generate traps indicating low battery power. When the batteries die, managed devices connected to the UPS systems go down. This precipitates a flood of events and alarms from the affected area, making it difficult for network management personnel to pinpoint and address the root-cause problem. Correlation strategy Determining the root cause of the problem enables troubleshooters to quickly restore the infrastructure. This can be accomplished by setting up a correlation system that produces a single alarm for the power outage with an impact that includes all the lost contact devices and UPS alarms listed as suppressed alarm symptoms. A correlation Policy that stipulates the following can be applied to the Domain including the resources that would be compromised by a power outage: When all UPS systems within a specific area (or Domain) fall over to battery backup power, a widespread, critical power outage in that area is likely. When this Condition exists, a power outage is assumed to be the root cause of all low battery alarms from the UPS systems and all lost contact alarms and other associated alarms for the devices connected to the power systems. 29

30 Chapter 6: Condition Correlation Examples Configurations The correlation system can be configured as follows: In SPECTRUM, a new Power Outage alarm is created. A set event and clear event for the new alarm is required. For more information on creating alarms and editing event configuration files, see the Event Configuration Files Guide (5070) and the Event Configuration Editor User Guide (2260). Two Conditions are created. - A Power_Outage Condition that uses the set event code and the clear event code associated with the Power Outage alarm. - A Battery_On Condition for a UPS on battery power using the set event code and the clear event code associated with the UPS trap. Three Rules are created. - A Battery On -> Power Outage Rule that stipulates when, for example, five or more power systems go on battery power, the Power Outage Condition is the implied cause. Symptom Condition(s): Battery On, Set: Counts Root Cause Condition: Power Outage Relationship: Implied Cause Root Cause Target: Correlation Domain Advanced Rule Criteria: configured as shown in Figure 6-1. Figure 6-1: Configuring the Battery On/Power Outage Rule 30 Condition Correlation User Guide

31 WAN Link Failure - A ContactLost_Red -> Power Outage Rule that stipulates if the ContactLost_Red Condition (CA-authored) is Caused By the Power Outage Condition, the critical (red) Contact Lost alarm is suppressed as a symptom of the Power Outage alarm. - A ContactLost_Gray -> Power Outage Rule that stipulates if the ContactLost_Gray Condition (CA-authored) is Caused By the Power Outage condition, the suppressed (gray) Contact Lost alarm is suppressed as a symptom of the Power Outage alarm. A Power_Outage Policy is created that includes the Battery On -> Power Outage, ContactLost_Red -> Power Outage, and ContactLost_Gray -> Power Outage Rules. A Backup_Power Domain is created that includes the UPS models and the device models that connect to the power supplies, and the Power_Outage Policy is applied to the Domain. WAN Link Failure This example describes one way that Condition Correlation can be used to pinpoint the root-cause alarm and symptomatic alarms among a barrage of alarms generated for different resources as a result of a WAN link failure. Scenario In many WANs, primary connections have a backup. The backup connection typically provides less bandwidth than the primary connection. In this example, a 384K Frame Relay link is backed by a 128K ISDN link. Also, a SPECTRUM Service Performance Manager (SPM) test is measuring latency across the WAN link. When the Frame Relay link goes down, the ISDN link takes over and the SPM test may exceed the latency threshold due to the reduced bandwidth. SPECTRUM generates two alarms (Critical Alarm - Frame Relay Link Down; Minor Alarm - SPM Test Exceeded Threshold) and one event (ISDN Backup Active). Correlation strategy It may not be apparent to network management personnel that these three Conditions are related, and they are likely to focus their effort on the critical alarm even though there may be other alarms in the infrastructure that are more important. A correlation Policy that stipulates the following can be applied to the Domain including the resources that would be compromised by a primary WAN link failure: The two alarms and the ISDN event can be correlated to generate a new primary link down, reduced bandwidth Condition that produces a major alarm because the WAN is still working, but with decreased performance. The failed Frame Relay Link can be correlated with the backup s Dialup Link Active event and imply that the primary WAN link is down with reduced bandwidth if the backup link bandwidth is less than the primary link bandwidth. The SPM test can be correlated with the primary WAN link down, reduced bandwidth Condition with a Rule that stipulates SPM Test Threshold Exceeded is caused by primary WAN link down, reduced bandwidth Condition. Condition Correlation User Guide 31

32 Chapter 6: Condition Correlation Examples This correlation system will produce the following alarm and event information: the single major alarm for the WAN link being down, SPM test threshold exceeded, and the ISDN backup active event. This allows troubleshooters to focus their efforts on the most important alarms. A second Rule could be created to produce a minor alarm if the active backup link has the same bandwidth as the failed primary link. Configurations The correlation system can be configured as follows: In SPECTRUM, a new Primary WAN Link Down, Reduced Bandwidth alarm is created. A set event and clear event for the new alarm is required. For more information on creating alarms and editing event configuration files, see the Event Configuration Files Guide (5070) and the Event Configuration Editor User Guide (2260). Two Conditions are created: - A Primary_WAN_Link_Down_Reduced_Bandwidth Condition using the set and clear event codes from the Primary WAN Link Down, Reduced Bandwidth alarm. - A Dialup_Link_Active Condition using set event 0x022ffff6 Dialup link has been activated and clear event 0x022ffffc Dialup link is inactive. This Condition is not linked to a SPECTRUM alarm. It does, however, infer that the backup, or secondary, link is up and running. Two Rules are created: - A PrimayFrameRelay_Red -> LinkDown Rule that states that if the Primary_WAN_Link_Down_Reduced_Bandwidth and Dialup_Link_Active Conditions occur, then the implied cause is the Primary_WAN_Link_Down_Reduced_Bandwidth Condition and the critical (red) Frame Relay Link Down alarm is suppressed by the Primary WAN Down, Decreased Bandwidth alarm (orange). - A SPMLatencyThreshold_yellow -> Violated Rule that states that the SPM latency threshold violation is caused by the Primary WAN Link Down, Reduced Bandwidth Condition, and yellow SPM latency threshold violation alarms are suppressed. A WAN_Link_Failure Policy is created that includes the PrimaryFrameRelay_Red -> LinkDown and SPMLatencyThreshold_yellow -> Violated Rules. A WAN_Primary_Backup_Links Domain is created that includes the primary WAN link interfaces, the backup link, and any SPM tests that could be impacted by the backup s lower bandwidth. The WAN_Link_Failure Policy is applied to the Domain. 32 Condition Correlation User Guide

33 Index A Advanced correlation 14, 19 C Caused By, rule relationship 18 Clear Event Code, condition property 14 Condition 8 advanced correlation parameters 14 creating 13 deleting 16 editing 16 Condition Correlation implementation examples 29 Condition Correlation Editor, opening 9 Condition Name, condition property 14 Condition, properties clear event code 14 condition name 14 set event code 14 Creating conditions 13 domains 25 policies 21 rules 17 Document OneClick document set 6 Domain 9 add and remove resources 26 creating 25 deleting 27 editing 27 E Editing advanced correlation parameters 15 conditions 16 domains 27 policies 22 rules 19 Implied Cause, rule relationship 19 Implies, rule relationship 19 I M Model attribute, condition parameter type 15 Deleting conditions 16 domains 27 policies 23 rules 20 D 33

34 P Parameter ID, condition parameter property 15 Parameter ID, type device model handle 16 model attribute ID 15 model handle 16 model type handle 16 varbind variable number 15 Parameter Name, condition parameter property 15 Parameter Type, condition parameter property 15 Parameter Type, options model attribute 15 predefined, device model 15 predefined, model 15 predefined, model type 15 var bind 15 Parameters, advanced correlation 14 Parameters, editing 15 Parameters, properties parameter ID 15 parameter name 15 parameter type 15 Policy 9 creating 21 deleting 23 editing 22 Policy Name, policy property 22 Policy Rules, policy property 22 Policy, properties policy name 22 policy rules 22 Predefined, condition parameter type 15 Rule 8 creating 17 deleting 20 editing 19 Rule criteria, advanced correlation 19 Rule Name, rule property 18 Rule, properties relationship 18 root cause condition 19 rule name 18 symptom condition(s) 18 Set Event Code, condition property 14 Symptom Condition(s) counts, numerical-based criteria 18 does not exists in correlation domain 18 exists in correlation domain 18 Symptom Condition(s), rule property 18 S V Var Bind, condition parameter type 15 R Relationship, Rule property 18 Relationship, rule property caused by 18 implied cause 19 implies cause 19 Resources adding to domains 26 removing from domains 26 Root Cause Condition, rule property 19 Root cause target, implies and implied cause relationships Condition Correlation User Guide