Event Management › Implementation Process › Message Traps and Actions › Correlation of Event Console Messages

Correlation of Event Console Messages

Correlation is the ability to relate two or more previously unrelated events.

A single message coming across the Event Console is often only important when seen in context with other messages. By constructing a series of message records and actions, you can be notified and can act if two or more events occur together that have more significance to your enterprise than any event in isolation.

If you have CA NSM, you can use the CORRELATE action in the Event Console to act on two or more messages to correlate them. Processing for this type of correlation can take advantage of messages that CCS components issue.

Example:

You have two UNIX computers in your accounting department. If one of these computers goes down, it is a problem and you probably have established Problem Management policies to deal with such an occurrence. If the second computer also goes down, the problem becomes critical and the action you want to take in this situation can be different.

A solution to the problem is to define message records that trap the event messages coming to the Event Console informing you that Accounting Machine #1 and Accounting Machine #2 are coming down. You can then define message actions for each message record that test for the occurrence of the other event message. You are automatically notified of the critical situation that exists in the Accounting department.

Sample procedures for two approaches to defining Event Management policy that correlates two incoming event messages are provided. See Enterprise Management in the online help.