Previous Topic: Message Enhancement

Next Topic: Event Management Policy Activation

Correlation of Event Console Messages

Correlation is the ability to relate two or more previously unrelated events.

It is often true that a single message coming across the Event Console is not important unless seen in context with other messages. By constructing a series of message records and actions, you can be notified and take action if two or more events occur that together have more significance to your enterprise than any one event in isolation.

If you have CA NSM, you can use the CORRELATE action in the Event Console to take action on two or more messages to correlate them. Processing for this type of correlation can take advantage of messages issued from CA Common Services for z/OS components.

Example:

You have two UNIX computers in your accounting department. If one of these computers goes down, it is a problem and you probably have established Problem Management policies to deal with such an occurrence. However, should the second computer also go down, the problem becomes critical and the action you want to take in this situation may be quite different.

A solution to the problem would be to define message records that trap the event messages coming to the Event Console informing you that Accounting Machine #1 and Accounting Machine #2 are coming down. You can then define message actions for each message record that test for the occurrence of the other event message. You will now be automatically notified of the critical situation that exists in the Accounting department.

Sample procedures for two approaches to defining Event Management policy that correlates two incoming event messages are provided. See Enterprise Management in the online help.