NOTICE: Branded Content
NOTICE: Certain versions of content (“Material”) accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.
Operations Bridge Idea Exchange
cancel

Close cause event if all Symptom events are closed

Currently it is possible to close all symptom events if cause event is closed but not vice versa. I have a SBEC rule which suppress event based on time and count and if condition is met then it create a new event. This new event will be considered as cause event and all the other events which has participated in this correlation will be symptom event of this newly created event.


We also receive following good events and it is possible that we receive good events for all. in that case all symptom events will be closed but cause event is still open which makes no sense. if all symptom events are closed then we would like to close the cause event as well.

Example: Due to network interruption you receive lot of node down alerts which will generate lot of events. This can be suppressed under one (cause) event. Once issue is gone and all the node down alerts are resolved, cause event should be closed automatically as there is no need to work on this event anymore.


Currently there is no workaround possible.

9 Comments
Micro Focus Expert
Status changed to: Waiting for Votes

Thanks for the idea. But do you really think, it should be done in the way you have suggested? In your example, you have created a NEW event that is categorized as cause and hence it stays open. In general, when cause-symptom relationship is identified automatically, both cause and symtom events are generated by monitoring which will generate good events when problem is solved so cause and symptom events will get closed automatically. For your example, could you have used one of the generated events as the cause while marking all other as symptoms?

Acclaimed Contributor..

For your example, could you have used one of the generated events as the cause while marking all other as symptoms?

>>>>> First of all it is not possible to choose cause and symptom events if i use one of the generated events.

cause_m.png

in case i am missing to find this hidden option, it will still not function as when modifying event i have option to choose either first or last event as reference. lets assume there are Events E1, E2, E3 . . . . . . E10. i use first event as a reference event so E1 is now considered as cause event. if we get following good events just for E1 then this event will be closed and this will lead to close all other symptom events which are in actual not resolved so it does not make sense to me and therefore i created a new event which allow an engineer to check all the symptom events and take action on any unresolved event(s) but if all symptom events had received following good events it make no sense to wake someone in the night where no action is required and therefore i think it is quite helpful to close cause event if all symptom events are closed.

Hope I was able to clarify and justify it.

-KAKA-

Valued Contributor..

 I am also looking for the similar solution.... Sitution of Mine is also as same as descriped by KAKA...

@Mgoyal : I am creating the new event as an action triggered from Repititions of events, example multiple Nodes Down from the same Location. For NOC Engineer one incident is sufficient instead of incident for all the Nodes Down... secondly we can't elevate one of the Node Down as a Cause and treat rest as a Symptoms in this scenario, as all of them are Nodes Down. 

so it would be great if we can implement some solution for it. Also any suggestions or options if this can be achieved using Groovy Script, if yes, on which Event Pipeline we can place it.

Regards, 

Santhosh K

Trusted Contributor..

HI, I am looking for the same solution where we have SBEC for Interface down events. As kaka explained there is no use to keep alive Cause events on console when real issue is resolved . Looking forrward to see some IDEA to be implemented by MF which help us in many cases.  

Thanks,

Goja

Thanks for the idea.Following.

Micro Focus Expert

I guess having an option to select the event type (cause or symptom) will be a good option (right now, in filter creation under SBEC, correlation is not visible). Also regarding the case said above, i believe it can be achieved through a repetation rule (to suppress and generate new event), and a combination rule ( closure of events and the new cause event), provided when generating the cause event, we have to add some custom attribute to identify this event later..

Btw how is it possible to generate a cause event ? how you did that?

Acclaimed Contributor..

Btw how is it possible to generate a cause event ? how you did that?

>>>>>> Check highlighted in blue box.

SBEC_Cause.png

I guess having an option to select the event type (cause or symptom) will be a good option (right now, in filter creation under SBEC, correlation is not visible).

>>>>>> So from above you know you can select event type. one cause event and rest all are symptom of it.

Also regarding the case said above, i believe it can be achieved through a repetation rule (to suppress and generate new event), and a combination rule ( closure of events and the new cause event), provided when generating the cause event, we have to add some custom attribute to identify this event later.

>>>>>> you can definitely set a custom attribute on cause event but we have no control over symptom events so i do not understand how you want to achieve it using a combination rule? can you show us an example?

-KAKA-

Valued Contributor..

Hi Mohd_25,

Also regarding the case said above, i believe it can be achieved through a repetation rule (to suppress and generate new event), and a combination rule ( closure of events and the new cause event), provided when generating the cause event, we have to add some custom attribute to identify this event later..

You mean in the combination close all the symptoms which identified, for that we no need to combination, that can be achievable wtih Repitiioin itself. Also no need for any CA too, because by default the new event became the top correlated event if you select that as a cause.

The issue is, espcially NNMi events, We receive the normal alert which clears the down event, and at certain point there will not be any symptoms (cleared by normal event), but only this new event which created for reduciing the Incident count stay alive and proceed for Ticket creation which makes no sense when there is no symptoms associated at the time of Ticket creation.

Hope this clarifies, however I am looking for an option with Groovy script to clear the top event if all the child got closed, but yet to finish it....

Regards,

Santhosh Kunhiraman

 

Acclaimed Contributor..

@Mgoyal - Hello Mamta, is there any workaround? Could you check with R&D? We need to workaround it somehow as this causes pager in midnights and BU is not happy about it. i went through API's available but could not figure out a way.

any hints in this regard is greatly appreciated.

-KAKA-