6.1.5 Custom incident attributes
NNMi uses custom incident attributes (CIAs) to attach additional information to incidents.
-
For an SNMP trap incident, NNMi stores the original trap varbinds as CIAs for the incident.
-
For a management event incident, NNMi adds pertinent information (for example, com.hp.ov.nms.apa.symptom) as CIAs for the incident.
You can use incident CIAs to narrow the scope of configurations such as incident lifecycle transition actions, suppression, deduplication, and enrichment. You can also use CIAs to narrow the availability of the application menu items for an incident view or form.
To determine the CIAs that NNMi adds for any given incident, open a sample incident from an incident view, and look at the information on the Custom Attributes tab.
- Organization of this subsection
(1) CIAs added to closed management event incidents
When the NNMi Causal Engine determines that the conditions that caused a management event incident no longer apply, NNMi sets that incident's lifecycle state to CLOSED and adds the CIAs listed in the table below to the incident. NNMi console users can see this information in the Correlation Notes field of the Incident form. Lifecycle transition actions can use the values of the CIAs directly.
|
Name |
Description |
|---|---|
|
cia.reasonClosed |
The reason that NNMi canceled or closed the incident. This reason is also the conclusion name, such as NodeUp or InterfaceUp. When this field is not set, it means that an NNMi console user closed the incident. To determine the NNMi expected values of a cia.reasonClosed CIA, see How NNMi Closes Incidents in NNMi Help. |
|
cia.incidentDurationMs |
The duration, in milliseconds, of the outage, as measured by NNMi from when the status goes down to when it comes back up. This value is the difference between the cia.timeIncidentDetectedMs and cia.timeIncidentResolvedMs CIAs. It is a more accurate measurement than comparing the down and up incident timestamps. |
|
cia.timeIncidentDetectedMs |
The timestamp, to the millisecond, when the NNMi Causal Engine first detected the problem. |
|
cia.timeIncidentResolvedMs |
The timestamp, to the millisecond, when the NNMi Causal Engine detected that the problem has been resolved. |
NNMi adds the CIAs listed in Table 6-3 to most primary and secondary root cause incidents. For example, a NodeDown incident can have InterfaceDown and AddressNotResponding incidents as secondary root causes. When NNMi closes the NodeDown incident, NNMi also closes the secondary incidents and adds the CIAs with values for each incident context to the secondary incidents.
NNMi does not add the CIAs listed in Table 6-3 to the following default management event incident types:
-
Incidents that an NNMi console user closes manually
-
Incidents that NNMi closes in response to an object being deleted from the NNMi database
-
IslandGroupDown incidents
-
NnmClusterFailover, NnmClusterLostStandby, NnmClusterStartup, and NnmClusterTransfer incidents
-
Incidents in the following families:
Correlation
License
NNMi health
Trap analysis