Release Notes › Known Issues › Event Correlation

Event Correlation

The following are the known issues related to event correlation.

Correlation Ignores Events Marked Ahead of the Server Time

Symptom:

The correlation engine ignores events with timestamps more than 5 minutes ahead of the CA User Activity Reporting Module server time.

Solution:

Such events are not considered for incident inclusion, regardless of the Correlation Event Span values.

Correlation Service Fails to Initialize on Startup

Symptom:

The correlation engine fails to initialize on startup. When this happens CA User Activity Reporting Module generates a Correlation Service log entry, and a self-monitoring event with the following text:

Unable to initialize service CorrelationService: java.lang.RuntimeException: com.ca.elm.common.repository.RepositoryException: Error authenticating to EEM <hostname>

Solution:

To resolve this issue, restart ELM Services using the following procedure:

1. Click the Administration tab, then the Services subtab, and expand the System Status node.
2. Select the CA User Activity Reporting Module server where you want to restart services.
3. Click Restart Services.

Correlation Rule Filters Fail to Identify Incident Events

Symptom:

An event correlation rule filter fails to identify events as expected when using wildcards. For example, a rule set to match the value "test*" does not return values beginning with "test", such as "testa"

Solution:

The correlation engine uses strict regular expression syntax as regards wildcards. So in this example, you would have to use "test.*" to return the results you want.

Line Break Does Not Function in Correlation Wizard Fields

Symptom:

In certain correlation rule field wizards, a line break cannot be created using "</BR>" This issue applies to the following fields:

• Incident Descripton in the Details step
• Incident Remediation in the Details step
• Subject in the Email tab of the Notifications step
• Text in the Email tab of the Notifications step

Solution:

The "<" character is not currently allowed in the listed fields, so the line break cannot be entered.