Your SlideShare is downloading. ×
0
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
HP Operations Manager i Topology Based Event Correlation
Upcoming SlideShare
Loading in...5
×

Thanks for flagging this SlideShare!

Oops! An error has occurred.

×
Saving this for later? Get the SlideShare app to save on your phone or tablet. Read anywhere, anytime – even offline.
Text the download link to your phone
Standard text messaging rates apply

HP Operations Manager i Topology Based Event Correlation

2,838

Published on

An overview of Topology Based Event Correlation (TBEC) and its features

An overview of Topology Based Event Correlation (TBEC) and its features

0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total Views
2,838
On Slideshare
0
From Embeds
0
Number of Embeds
0
Actions
Shares
0
Downloads
187
Comments
0
Likes
0
Embeds 0
No embeds

Report content
Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
No notes for slide

Transcript

  • 1. Session ID: BTOT-WE-1000-9<br />Twitter hashtag #HPSWU<br />
  • 2. HP Operations Manager iTopology Based Event Correlation<br />Concepts and Operation<br />Speaker Name: Dave Trout, HP BSM Customer Assist Team<br />Date: 30-Nov-2010<br />Session ID: BTOT-TU-1600/2 <br />
  • 3. Agenda<br />3<br />HP Confidential<br />TBEC in action (What does it do?)<br />Basic concepts of TBEC<br />Using the Correlation Manager<br />Automatic cross-domain correlation <br />New TBEC features in OMi 9.0<br />Summary<br />TBEC = Topology Based Event Correlation<br />
  • 4. TBEC in action<br />Demo<br />
  • 5. TBEC Basic Concepts<br />
  • 6. BSM Service Health hierarchy<br />6<br />HP Confidential<br />Service Health System<br />Event Management<br />
  • 7. 7<br />HP Confidential<br />ETI = Event Type Indicator<br />ETI is an attribute of an event<br />Indicates concise status of managed infrastructure element<br />Set based on a hint* in the event or via server based mapping filters<br />Are defined per CI Type<br />Only pre-defined ETIs are evaluated when events arrive<br />Valid for all derived CI Types<br />Custom Attribute “EventTypeIndicator” = “<ETI name>:<ETI value>”<br />*<br />
  • 8. Correlation requires ETIs<br />8<br />HP Confidential<br />Event Type Indicators are used to define correlation rules<br />Only Events with Event Type Indicators can be correlated <br />
  • 9. Cause and symptom events<br />9<br />HP Confidential<br />Something goes wrong in your environment<br />Monitoring reports multiple problems via events<br />Usually just one of the events describes the cause of the problem<br />Others are just symptoms<br />Fix the cause and also the symptoms go away<br />In a nutshell, TBEC identifies CAUSE and SYMPTOM events<br />
  • 10. Topology: the “T” in TBEC<br />10<br />HP Confidential<br />The other part is the CI type topology <br />Cause and symptoms are one part of a rule <br />
  • 11. Correlation requires relationship<br />11<br />HP Confidential<br />Symptom<br />Event3<br />Ping:Unavailable<br />Cause<br />Event1<br />Ping:Unavailable<br />Event2LinkStatus:Down<br />
  • 12. Time window for correlation<br />12<br />HP Confidential<br /><ul><li>Even if cause and symptom and the connecting topology match, events might not be correlated
  • 13. Events have to arrive within a certain time window
  • 14. A time window starts when the first cause or symptom event arrives that cannot be correlated with any other event
  • 15. Default time window is 16 minutes
  • 16. Each correlation rule can have its own time window which overrides the global setting</li></ul>Correlation Window<br />No correlation<br />Time<br />Event<br />Event<br />
  • 17. A simple correlation rule<br />13<br />HP Confidential<br />What the rule defines:<br />IF the system receives an event that sets LinkStatus = Down<br />AND IF the system receives an event that sets Ping Availability = Unavailable<br />AND IF the Router and Computer are somehow connected (topology)<br />AND IF that happens at roughly the same time<br />THEN the system will mark the LinkStatus Down event as CAUSE and the Ping Availability Unavailable event as SYMPTOM<br />
  • 18. TBEC correlation rules – semantics<br />14<br />HP Confidential<br />A correlation rule shows possible cause-symptom relationships:<br />If the two events happen within a defined window of time, then correlate. Otherwise do nothing.<br />A correlation rule does NOT say<br />If I have that cause, then I will see that symptom (impact)<br />If I see that symptom, then I must have this cause for it<br />One cause can have multiple symptoms (and not all have to appear at the same time)<br />
  • 19. Usage when defining rules<br />15<br />HP Confidential<br />A correlation rule must include at least one CAUSE and one or more SYMPTOMs<br />Multiple CAUSE specifications are allowed if they reference the exact same CI Type<br />A SYMPTOM in one rule can be configured as a CAUSE in another rule (and vice versa)<br />TBEC Cause/Symptom<br />
  • 20. Correlation Engine behavior<br />16<br />HP Confidential<br />A correlation rule triggers when a CAUSE event and any combination of specified SYMPTOM events occur within the correlation time window<br />CAUSE and SYMPTOM events can occur in any sequence within the time window<br />A rule which would otherwise mark an event as a SYMPTOM will be ignored for the event if it is already marked as a SYMPTOM to a different CAUSE event<br />A duplicate CAUSE event which arrives during a correlation window is correlated and handled like a SYMPTOM event<br />TBEC Cause/Symptom<br />
  • 21. Browser-related behavior<br />17<br />HP Confidential<br />If a CAUSE event is assigned to an operator:<br />Default: Assignment propagates to SYMPTOM events<br />option: no propagation<br />If the lifecycle state of CAUSE event is changed:<br />Default : new lifecycle state propagates to SYMPTOM events<br />option 1: Disable propagation except for “Close” operation<br />option 2: Disable propagation but “Close” operation unrelates SYMPTOMs<br />If a SYMPTOM event arrives after a CAUSE event is closed:<br />Default: Any SYMPTOM events will be correlated (and also closed) until the current correlation window expires<br />option: no correlation, SYMPTOM event is not closed<br />TBEC Cause/Symptom<br />Correlation behavior is configured in Platform Settings<br />
  • 22. Correlation Window – Auto Extend Mode<br />18<br />HP Confidential<br />Correlation Window<br />Time<br />Auto Extend Mode = False<br /> Symptom Event<br />Event<br />Cause Event<br />Correlation<br />Window<br />Extended Correlation Window<br />Time<br />Auto Extend Mode = True<br />(default)<br />Symptom Event<br />Event<br /> Symptom Event<br />Cause Event<br />
  • 23. OMi event pipeline<br />Run Time Service Model<br />Admin<br />ContentManager<br />Indicator Manager<br />View, create and modify correlation rules<br />Correlation Manager<br />Events<br />OMi Browser<br />ETI<br />Value<br />CI<br />CI<br />Event to CI Mapping<br />Event Correlation<br />Event to ETI Mapping<br />KPIs<br />CI<br />HI<br />Value<br />HI<br />Value<br />CI<br />HI<br />Value<br />If configured, attach HI-Value to CI<br />Health<br />BSM Platform<br />KPI calculation<br />19<br />HP Confidential<br />Event<br />Event<br />Event<br />Event<br />Event<br />Event<br />
  • 24. Using the Correlation Manager<br />
  • 25. Correlation Manager<br />21<br />HP Confidential<br />Define, deploy, and manage correlation rules<br />Visualize the topology of correlation rules<br />View CAUSE and SYMPTOM events in rules<br />View assigned and available Event Type Indicators and their values<br />Browse the hierarchy of cross-domain correlation rules<br />Access to Correlation Manager is controlled by user role settings<br />
  • 26. Correlation Manager UI<br />22<br />HP Confidential<br />List of rules currently defined <br />Available ETIs of selected CI type <br />CI type topology of selected rule <br />Causes and symptoms of selected rule <br />
  • 27. What you need to know<br />23<br />HP Confidential<br />working knowledge of CI Types and the BSM type model<br />working knowledge of UCMDB Views<br />understanding of Event Type Indicators<br />detailed knowledge of the events which you want to correlate<br />event domain (networking, database, storage, etc.)<br />ETIs specified in the events<br />event relationships (Cause, Symptom)<br />Creating TBEC rules<br />
  • 28. Basic workflow sequence<br />24<br />HP Confidential<br />Create new rule using the * button<br />Define rule properties (name, description, time window, etc.)<br />Select a topology (UCMDB) view which includes the CI Types and relationships you want to use in the rule<br />Define CAUSE event(s):<br />Select a CI Type in the View<br />Select an ETI and ETI value from the list of available ETIs and “Add as a Cause”<br />Define SYMPTOM event(s):<br />Select a CI Type in the View<br />Select an ETI and ETI value from the list of available ETIs and “Add as a Symptom”<br />Correlation Manager highlights the shortest relationship path<br />If a different path is desired, select the appropriate relationship connectors<br />Creating TBEC rules Creating TBEC rules<br />
  • 29. Completing rule definition<br />25<br />HP Confidential<br />After saving, visualized rule topology is simplified<br />Rule is valid <br />Save when finished<br />Relations between cause and symptom CI type are automatically added <br />
  • 30. Automatic cross-domain correlation<br />
  • 31. Chaining of correlation rules<br />27<br />HP Confidential<br />CI Type<br />ETI:value<br />WebApp<br />Storage Domain<br />TXAvail:Unavailable<br />Logical Volume<br />Quota:Exceeded<br />Database Instance<br />Tablespace<br />StorageCapacity:Critical<br />Storage Server<br />Database Domain<br />Physical Disk<br />App Server Domain<br />Utilization:Full<br />
  • 32. Relations between correlation rules<br />28<br />HP Confidential<br />Triggered rules are connected (chained together) at runtime when they include a Cause or Symptom event that<br />resolves to the exact same CI<br />and has the exact same ETI and ETI value<br />Chaining is automatic; no configuration is required<br />Rules can trigger in any sequence<br />
  • 33. New in OMi 9.0<br />
  • 34. New features in OMi 9.0<br />30<br />HP Confidential<br />Manually relate selected events in browser<br />CAUSE event is marked from a group of selected events<br />Browser shows “Cause” and “Symptom” icons on the events<br />does not create a future relationship, i.e. no correlation rule is created<br />event lifecycle state changes and user assignment on CAUSE event are also marked on SYMPTOM events<br />Create new correlation rule directly from selected events(Correlation Generator)<br />Enhance existing correlation rule directly from selected events (Correlation Generator)<br />
  • 35. Using the Correlation Generator<br />31<br />HP Confidential<br />Creating a rule from events<br />If two events often occur at the same time, and if one is always the cause...then a new correlation rule can be created by <br /><ul><li>selecting the two events and
  • 36. selecting Create Correlation Rule from the context menu</li></li></ul><li>Correlation Generator wizard<br />32<br />HP Confidential<br />User selects CAUSE event<br />Generator retrieves relationships between cause CI and symptom CIs from model automatically<br />shortest route automatically selected<br />Cause and symptom ETIs from selected events automatically added<br />Generates a valid correlation rule<br />
  • 37. Correlation Rules in OMi<br />33<br />HP Confidential<br />OMi delivers artifacts like correlation rules, ETIs, HIs, KPIs, tool definitions, etc. using Content Packs<br />Content Packs are included with OMi license<br />OMi 9.0 Content Packs:<br />Infrastructure (includes system, cluster and virtualization artifacts)<br />Oracle<br />MS SQL Server<br />J2EE App Server (WebLogic, WebSphere)<br />Exchange<br />Active Directory<br />175+ correlation rules are provided<br />
  • 38. TBEC delivers operational efficiency<br />34<br />HP Confidential<br />Operators can quickly identify cause events in the browser<br />Operators work on cause events instead of wasting time on multiple symptom events<br />Fewer invalid escalations to cross-domain tier 2/3 specialists<br />Escalations which DO occur are sent to the right specialist<br />Correlation rules continue to work as the infrastructure changes since they are based on discovered topology<br />Rules can be created directly from events in the browser<br />Automatic “chaining” of correlation rules to cover cross-domain scenarios<br />Lower cost of event/fault management<br />
  • 39. Thank you for attending!<br />
  • 40. Continue the conversation with your peers at the HP Software Community hp.com/go/swcommunity<br />

×