Administration Guide › Services and CA Adapters › Service Configurations › Correlation Service Considerations

Correlation Service Considerations

The Correlation Service controls the rules applied on the correlation server. When you apply a rule it becomes active.

You can associate notification destinations with rules, and enable or disable rules from the Correlation Service Configuration page. You can choose which CA Enterprise Log Manager servers route events to the selected correlation server, or set an Event Limit.

Event Limit

Defines how many events are retained per incident when accumulation is enabled. The Event Limit helps prevent undue traffic caused by correlation in periods of high activity. When this limit is reached, additional events are lost. For example, if your limit is set to 100, a single rule can accumulate up to 100 recorded events, including the initial qualifying event or events. Accumulation continues until the event limit is reached, or more usually, gap or limit values reset the rule.

You can also remove applied correlation rules, making them inactive.

To remove rules from the applied list

1. Highlight the row for the correlation rule you want to remove.
2. (Optional) You can control-click or control-shift to highlight multiple rows.
3. Click Remove.

   The highlighted rules are removed from the active list.

4. Click Save to confirm the configuration. If you have not saved, you can click Reset to restore removed rules to the list.

   Note: This procedure only removes correlation rules from the active list. They are not removed from the rule library.

More information:

Apply Correlation Rules and Incident Notifications

Set Collection Servers