Event noise reduction indicator for prioritized triage and remediation
Event noise is the term used to describe the hundreds of hourly and daily notifications and alarms (for example, CPU utilization, memory utilization, end user response time) delivered by monitoring systems to IT Ops teams to show the health and performance of infrastructure and applications across their IT environment. Event noise reduction involves reducing the event storm by combining multiple matching events into a single aggregated event. Event noise reduction enables you to perform prioritized triage and remediation.
Noise reduction in BMC Helix AIOps uses an ML-based event correlation algorithm and no-code functionality to deduplicate, reconcile, and group all the events coming from both BMC and third-party tools to create Situations. Creating Situations is achieved in near real-time using event timestamps, message text, and topology.
The noise reduction widget shows the percentage of the all events correlated into Situations. You can view the noise reduction value in percentage and its trend on the Overview page as shown in the following example:
Event noise reduction computation
The following computation is used to derive the noise reduction value in percentage.
Consider the following example to understand how the noise reduction value is computed:
Total number of service associated events in the system (totalEventsAssociatedwithServices) = 50
Total number of ML-based situations in the system (primaryEvents) = 10
Total number of events associated with the ML-based situations in the system (secondaryEvents) = 20
noiseReduction(%) = ((secondaryEvents-primaryEvents)/totalEvents)*100) = ((20-10)/50)*100 = 20%
What are total events?
Total events are the events that are associated with a service and contain a Service ID.
What are primary events?
A primary event is an aggregated event derived from several matching events. For example, you can derive a single event from the secondary events listed in the following example: The
host1.bmc.com host is shutting down. The primary event should match the following conditions:
- Class = Situation
- Algorithm Name = ML
evcountmust be greater than
rstatvalue must be