Correlating Important Events › Advanced Event Correlation

Advanced Event Correlation

Advanced Event Correlation (AEC) integrates seamlessly with Event Management to provide a powerful event correlation, root cause, and impact analysis capability. When used with existing CA NSM features, AEC can increase the quality and reduce the quantity of the information reported on the Event Console, which is used to automate certain operational tasks.

In simple terms, event correlation is a way to group associated events together for the purpose of further processing. Grouping events in this way lets you do simple but powerful forms of processing, such as event suppression, reformatting, aggregation or consolidation. For example:

• Suppress events according to source, duplication, transient states (for example, a flapping link), frequency, thresholds associated with field values, and so on.
• Combine (aggregate) information spanning multiple events into one event.
• Extract data from events that may be difficult to extract using existing tools, making it available for further processing through automation.
• Reformat events for easier processing or to be more readable for operators.
• Detect the absence of scheduled events, such as a Backup Complete. Event correlation can also facilitate more powerful contextual forms of processing, such as root cause analysis and impact analysis.
• Enrich events with properties from external sources, such as WorldView managed objects.

Root cause analysis lets you clearly differentiate the root cause event associated with an event stream from the non-root cause or symptomatic events that may not require a direct response. Root cause analysis helps you to reduce the number and frequency of events seen by console operators, eliminate message flooding, and reduce false notifications.

Symptomatic events can provide valuable information about the impact of the root cause problem on the overall system, and, therefore, should not be discarded in all cases. The impact analysis function helps you alert users to an impending problem, thus reducing the load on your help desk. It also helps you to initiate failover or recovery procedures for the dependent systems, or alert operations staff that they need not address a particular problem.

Note: On non-Windows platforms, AEC is installed with the Event Manager and Event Agent. On Windows, AEC is a separate component.