Network Management / (OpenView-NNM) Practitioners Forum
Showing results for 
Search instead for 
Do you mean 

Casual Rule not working with 2 child incidents, each child for its own creates the parent incident

Highlighted
Advisor

Casual Rule not working with 2 child incidents, each child for its own creates the parent incident

Custom Correlation - Casual Rule:
NodeDown event CE-router + InterfaceDown event Tu0 at VPN-router = new management event „Site not available“
after correlation cindow duration of 5 minutes (see attachment).

How does this casual rule with its child incidents look like?

Casual Rule name: Site_NOT_available
Author: Customer
Enabled: checked
Parent Incident: Site_NOT_available (self created Management Event)
Correlation Nature: Info
Common Child Incident Attribute: ${valueOfCia(\QLocation\E)}
Correlation Window Duration: 5 minutes

First child incident:
Name: MPLS-CE-router_NodeDown
Child Incident: NodeDown
Forward Child Custom Incident Attributes: ${valueOfCia(\QLocation\E)}
Optional Child Incident = unchecked
Use Child Incident's Source Object for Parent = checked
Use Child Incident's Source Node for Parent = unchecked

No Child Incident Filter and no Source Object Filter.
Source Node Filter: Filter String ${sysName} = routers system name

##
Just for information:
- If the "Child Incident: NodeDown" is the only child, the NodeDown event is closed by creating the Parent Incident "Site_NOT_available".
- If the "Child Incident: InterfaceDown" is the only child, the NodeDown event is closed by creating the Parent Incident "Site_NOT_available".
##

Second child incident:
Name: VPN-Router_InterfaceDown_Tu0
Child Incident: InterfaceDown
Forward Child Custom Incident Attributes: (empty)
Optional Child Incident = unchecked
Use Child Incident's Source Object for Parent = unchecked (checked if the "Child Incident: InterfaceDown" is the only child)
Use Child Incident's Source Node for Parent = unchecked (checked if the "Child Incident: InterfaceDown" is the only child)

Child Incident Filter: Filter String: (${valueOfCia(\QService\E)} = VPN AND ${valueOfCia(\QLocation\E)} = Sitename)

No Source Object Filter and no Source Node Filter

 

I need help with this topic otherwise I'm going to need a big botttle hair restorer.....