4.3.2 Defining correlation event issue
To issue correlation events, you must prepare a correlation event generation definition.
A correlation event generation definition consists of multiple generation conditions, each of which contains several items.
The following figure shows the structure of a correlation event generation definition.
|
|
![[Figure]](GRAPHICS/CS031510.GIF)
Define the above items in a correlation event generation definition file. The items and their meaning are explained next. For details about how to specify each item, and the input rules and restrictions, see Correlation event generation definition file in Chapter 2. Definition Files in the manual JP1/Integrated Management 2 - Manager Command, Definition File and API Reference.
Note that JP1 users cannot define correlation events. To define correlation events, contact the system administrator.
- Organization of this subsection
-
(1) Correlation event generation condition name
A name identifying the correlation event generation condition.
(2) Filtering condition for the correlation target range
A condition for filtering the range of JP1 events processed according to the correlation event generation condition.
As the filtering condition, specify an attribute value of the target JP1 events. For example, by specifying the name of the event server that issued the event (B.SOURCESERVER), you can restrict the processing to issue correlation event to JP1 events issued from a specific agent host.
(3) Event condition
A condition for determining a JP1 event (correlation source event) that triggers a correlation event.
Specify an attribute value of the JP1 events targeted or excluded from the processing to issue correlation event. You can specify multiple event conditions in a generation condition.
When you specify multiple event conditions, those that exclude specific JP1 events (NOT specification) are applied first.
(4) Timeout period
The maximum wait time for a JP1 event matching an event condition.
The timeout period is counted from the arrival time (a basic attribute of JP1 events) of the first JP1 event matching an event condition. If the specified timeout period elapses without the generation condition being met, no correlation event is issued and the correlation processing terminates.
The following example shows when the generation condition is satisfied and when it fails for a succession of events A, B, and C.
|
|
![[Figure]](GRAPHICS/CS031520.GIF)
(5) Event correlation type
The method by which JP1 events matching an event condition are correlated.
There are three event correlation types:
-
Correlation based on event sequence
The correlation event generation condition is satisfied or fails according to whether JP1 events matching the defined event conditions are issued in a set sequence.
-
Correlation based on event combination
The correlation event generation condition is satisfied or fails according to whether JP1 events matching the defined combination of event conditions are issued, regardless of the order in which they occur.
-
Correlation based on thresholds
The correlation event generation condition is satisfied or fails according to whether the number of issued JP1 events matching a defined event condition reaches a set threshold.
(6) Duplicate attribute value condition
A condition that groups JP1 events matching an event condition on the basis of their attribute value, and issues a correlation event on a group basis. Multiple duplicate attribute value conditions can be specified in a generation condition.
In a duplicate attribute value condition, you can specify a JP1 event attribute name or part of an attribute value. For example, suppose JP1 events indicating an authentication error are associated and issue a correlation event. By specifying the name of the server that issued the event (B.SOURCESERVER), you can issue correlation events on an authentication server basis.
(7) Maximum correlation number
The maximum number of sets of JP1 events that can be processed concurrently by one correlation event generation condition.
The default when this item is unspecified is 10. When 10 sets of target JP1 events have been acquired for one generation condition, any further target JP1 events that are acquired during correlation processing of that condition will not be processed.
In this case, warning message KAJV2301-W is output to the integrated trace log.
For example, suppose a duplicate attribute value condition is specified, and correlation events are issued by each of the 50 servers in the system. If each server issues a JP1 event at the same time, the first 10 sets of JP1 events can be processed, but the remaining 40 sets cannot. In this type of situation, you would specify 50 sets as the maximum correlation number.
The following figure shows how the correlation processing works when the maximum correction number is the default (10 sets).
|
|
![[Figure]](GRAPHICS/CS031800.GIF)
- Important
-
A maximum of 20,000 sets of JP1 events can be correlated concurrently by all the correlation event generation conditions. Avoid specifying a large maximum correlation number in a large number of generation conditions.
When the number of JP1 event sets under correlation reaches 20,000, the KAJV2322-W message is issued and correlation processing stops. Once the number of JP1 event sets under correlation is greater than the maximum value of 20,000, the KAJV2322-W message is not displayed again until the number decreases to 16,000.
(8) Correlation approval event
A JP1 event (correlation event) that is issued when a correlation event generation condition is satisfied. You can specify any attribute name and any attribute value for the correlation event. By using a variable to specify an attribute of the correlation source event, you can pass the attribute value to the correlation event.
For details about issued correlation events, see 4.3.8 Issued correlation event.
(9) Correlation failure event
A JP1 event (correlation event) that is issued when a correlation event generation condition is not satisfied. You can specify any attribute name and any attribute value for the correlation event. By using a variable to specify an attribute of the correlation source event, you can pass the attribute value to the correlation event.
For details about issued correlation events, see 4.3.8 Issued correlation event.