Correlating Important Events › Advanced Event Correlation › How AEC Works

How AEC Works

AEC extends the functionality of Event Management. To use AEC, you must first identify a set of events that you want to monitor and correlate, and specify any actions to perform if correlation exists or does not exist. The events to be monitored are reported to the Event Console as messages that act as input to AEC, and are intercepted and analyzed. You configure AEC to act on the input messages it receives to produce the desired output, which are the messages that are actually sent to the Event Console.

AEC uses correlation rules to analyze the input messages in relation to each other and to identify the root cause messages from those incoming messages. A correlation rule performs the following functions:

• Describes patterns so as to recognize those incoming messages that are related
• Defines timings on when to report root cause messages to the Event Console
• Captures the logic of cause-and-effect relationships of all related messages
• Describes formatting of the root cause messages reported to the Event Console

AEC processes events as follows:

1. Listens to all incoming messages.
2. Uses patterns in the rule to identify the incoming messages that match.
3. Triggers the correlation rule when a matched message is detected.
4. Listens to incoming messages to see if any more messages match the patterns in the rule.
5. Uses timing, specified in the rule, to determine continuation of monitoring.
6. Stores the logic of cause-and-effect relationships of different messages.
7. Identifies which incoming messages are root causes, based on the cause and effect logic.
8. Applies the formatting specified in the correlation rule.
9. Reports the resulting message to the Event Console.