User Manual Cisco Systems Network Hardware 3.6 [68/68 Pages]

Cisco Systems network hardware 3.6

B-4

Cisco Active Network Abstraction Fault Management User Guide, Version 3.6 Service Pack 1

OL-14284-01

Appendix B Event and Alarm Correlation Flow

Event Correlation Flow

If it is box-level correlation the event is stored in the application for the correlation delay period and

during this period collects all possible root causes having the same correlation delay.

If it is flow-level correlation, then the flow will start after the correlation delay.

2. The flow starting and ending points are defined by the event correlation parameters (see Table B-1).

3. After the flow finishes it will get a message that contains all the collected alarms. Alarms are

collected on every DC that the flow intercepts regardless of the original correlation key of the event

that triggered it.

Correlation Logic (Event Correlator)

The correlation logic is used for determining the most fitting alarm to serve as a root cause for the

specified event. It selects from the alarms, the most fitting alarm (root cause), based on the correlation

filters and selects the root cause method.

Alarm Sending (Event Correlator)

Once an event has gone through the correlation process it will be transformed into an alarm and will be

sent to the gateway.

Post-Correlation Rule (Event Correlator)

The post-correlation rule is used for performing logic which needs to be performed after the event had

been sent. Usually the post-correlation rule is used for triggering additional behaviors such as search for

affected services that where influenced by the alarm.