Viewing related events in the TrueSight console

Correlate rules build a cause-effect relationship between two events, where one event occurs as a result of the other event. Correlate rules execute whenever a cause or an effect event is received. When you execute a remote action, related events are raised. Event relationships help you understand which events are related and how they are related. 

Infrastructure Management includes .mrl files in which event relationships are defined. The cell processes events as per the rules in the .mrl files. The Relationship Type and Rule or Policy columns are populated with data as per these files. For more information about .mrl files and rules, see Event rules. 

About event relationships

You can establish a relationship between two CIs or events by defining rules and policies.

For example, consider the following scenarios:

Scenario 1

Create a correlation policy between the following cause and effect events:

• Cause event could be a CPU reaching 80% usage for a device.
• Effect event could be response time of web URL hosted on that device is slow.

When you select the web URL event and view the event relationship, the Event Relationship window displays the cause event. By viewing and resolving the cause event, the effect event gets automatically resolved. In this example, by resolving the CPU issue the response time of the web URL improves.

Scenario 2

Create an Abstraction rule to generate an event when an application server and web server services of an online shopping portal is down with a message "Online shopping portal is down." If both these events are generated and you have taken no action, an abstraction event is generated with the message "Online shopping portal is down." You can view and take relevant action on these events.

For more information about creating and using user-defined policies, see Creating and using user-defined policies and for more information about rules for policy types and how to create them, see Creating the event processing rule(s) for a new policy type.

Viewing event relationships

1. Go to the Monitoring > Events page.
2. Under the Message column, look for the View Event Relationships icons displayed for an event.  These icons indicate that an event has relationships.
   • The  icon indicates that the particular event is the main event (parent event) to which other event(s) are associated. 
   • The  icon indicates that the particular event (child event) is associated with the main event (parent event).
   • The icon indicates that the particular event is the main event (parent event) as well as an associated event (child event). This means the event is a parent to some events and child of another parent event.
   • The icon indicates that the event is a parent event as well as a child event.

3. Click the icon to see the related events.
   The Event Relationships tab displays the related events. 
   You can also see the event details of a related event.