Correlating Important Events › Advanced Event Correlation › Implement AEC › Components of a Correlation Rule › Boolean Logic Rule Components › Boolean Operators

Boolean Operators

Each Boolean rule can have one or more nested Boolean operators, each with one or more pipeline items. These Boolean operators let you establish complex relationships among messages. When AEC receives many messages that are matched by different pipeline items, it performs the logical Boolean operations to determine if all conditions have been met.

For example, assume you define a rule that contains the following components:

Boolean Operator AND has been selected.
Pipeline Item # 1: Disk I/O Usage Critical
Pipeline Item # 2: Database Backup Starting

When AEC detects both events (Item # 1 AND Item # 2) occurring within the maturity period, it generates a correlation event. In this example, you may want to stop the database backup to save disk I/O.

The following components of Boolean operator pipeline items are the same as a pipeline rule:

• Match Event
• Exclusion Event
• Reset Request Event
• Local Reformat Event
• Reset Request Acknowledge Event

Note: The Local Correlation Event, Local Reset Event, Local Impact Event, and Local Revised Correlation Events are not available in a Boolean pipeline item, because all pipeline items must be considered together in a Boolean rule. Use the root versions to generate these output events.