Correlating Important Events › Advanced Event Correlation › Impact Analysis

Impact Analysis

You can configure AEC rules to generate, in addition to root cause messages, messages associated with the events impacted by the root causes.

AEC analyzes input messages to determine the impact a failure has on a component of a system. AEC responds by sending out impact analysis messages based on its rules. These messages can contain specified substrings from both the root cause and the impacted message. In addition, these impact messages can be sent to the Event Console in the form of an aggregate report, one for each non-root cause.

AEC recognizes a dependency of event A on event B (which is defined in the correlation rules), so you can use it to report impact messages like the following:

• A is impacted because B went down
• B has impacted A
• B has impacted [A1, A2, A3, A4]

For example, an operator shutdown on US-NY-01 has caused a ping failure and an agent failure.

You can use impact analysis to do the following:

• Provide the operators with complete and intelligent information, enabling them to understand and provide notification of the failures in the enterprise.
• Use impact messages to notify the repair personnel to fix the real failures. These messages can also be used to notify users that "false" failure of components has impacted their hardware or software.
• Make infrastructure changes that affect the impacted components, after receiving impact messages.

  For example, a router failure has caused a group of applications to fail because they have been disconnected from the database server. After receiving the impact messages, provide an alternate route or use a failover router from the applications to the database server that would bypass the failed router, thereby reducing the downtime of these applications.

• Provide system administrators with a way to measure the impact of failures of hardware and software throughout the enterprise—measuring not only the downtime of the failed component, but the impact of the failure on all affected components.

  For example, a failure on a router that is connected to two less critical workstations may not necessitate a repair until hours later. However, a failure on a router that supports hundreds of servers that house an enterprise’s main applications, which are accessed in real time by its clients, requires an immediate fix.