By gathering data from different sources and applying filters to rule out unrelated events, BMC TrueSight Operations Management can determine the most likely causes for an event, such as an attribute that is outside the valid range. This process of gathering and filtering data to determine the cause for an event is called probable cause analysis.
The probable cause analysis process analyzes data and displays the relevant events automatically. You can increase the accuracy of probable cause analysis by providing relationships between devices and monitors. The more data you provide about an event, the more accurate the results of the probable cause analysis will be.
To perform probable cause analysis on an event, the event should be associated with a device. If not, no related events are displayed.
Export the event and check the value for mc_host_id. A value of zero indicates the event is an external event and no related events are displayed.
This topic provides the following information:
Choose the options that help you to narrow down or broaden your criteria:
Analysis focus (2)
You can choose from four different levels. You can even customize these levels.
Level 1 gives you the most related events, while level 4 broadens your criteria and includes a wider range of events.
Time range (3)
Drag the slider to select the time interval, before and after the event.
The KPI information for legacy Infrastructure Management monitors is not available in the Presentation Server. As a result, when you perform probable cause analysis on such events at analysis focus level 1, no related events are displayed. Choose focus levels 2, 3, or 4 to view related events.
Change the settings, described in the following table, to meet your requirements:
|Correlates data using the data collected for the resulting event and the probable cause event. Data correlation is applicable only to intelligent events.
Correlate Metric Data
|Correlates the metric data of the primary event against the metric data of each candidate event. Only the metric data within the analysis window is analyzed.
For example, if you select - 1 hour and + 1 hour in the time window slider, up to 2 hours of data are analyzed.
Correlate Metric Data with Previous Abnormalities
|Correlates data between the metric of the primary event against other metrics for the time periods at which the primary metric was abnormal in the past (subject to data retention limits.) This setting can produce more accurate data correlation results at the cost of increased processing time. However, the results might take up to 3 times longer to return.
|Set as Default Filter Level
Select the filter level to set as the default and select this checkbox.
To customize a filter level, select the filter level, make the necessary changes, and click Save.
The icon indicates that the filter level has been customized.
|Exclude Events for Non-KPI Metrics
|Select this option to exclude events by non-Key Performance Indicators (KPI).
|Include Only Highest Scoring Event Per Metric
|Select this option to display only the event with the highest score, in case there are multiple secondary events for the same monitor instance.
|Include Events in Primary Event's Application Models
|Select this option to include events based on the impact relationships defined for the CI associated with the primary event.
|Include Events Matching Global Relationships
|Select this option to control whether the built-in global relationships are used to determine probable cause.
|Exclude Events Not Associated With a CI
|Select this option to exclude an event that is not associated with a device or a CI.
|Include Events Scoring More Than
|Select this option to include events with a score higher than that entered in this field. After the probable cause analysis identifies the probable cause events, each event is scored and only the events whose score is above the specified limit are shown as root cause in the probable cause analysis page.