To maximize the capabilities of BMC ProactiveNet Probable Cause Analysis, configure your BMC ProactiveNet system as recommended by the following guidelines.
BMC highly recommends that you do a thorough review of your deployment to set appropriate Key Performance Indicators (KPIs) for your environment.
Baselines and abnormalities are automatically generated for KPIs. Thus, having the correct set of KPIs allows Probable Cause Analysis to work even better. For information about KPIs, see Viewing the Details notebook.
You must configure complete monitor coverage for your entire infrastructure. Complete monitor coverage is key to the accurate working of the Probable Cause Analysis process. Complete monitor coverage includes monitors at the system level, application level, and network level. If the coverage is not sufficient, then probable cause shows that no event is correlated. If monitors do not cover all dependencies in your infrastructure, then it is almost impossible to drill-down to the granular cause of a problem.
You must create service models for CIs that have dependencies on one another. You can create service models using the BMC ProactiveNet Administration Console or BMC Impact Model Designer. For information, see Working with BMC ProactiveNet Infrastructure Management and Building a service model in BMC Impact Model Designer.
When you create a service model by using the Associate Monitors feature in the Administration Console, ensure that you associate the monitor with the proper CI. For information on associating monitors with the proper CIs, see Associate monitors with CIs through the BMC ProactiveNet Administration Console.
BMC recommends using the default polling frequency. However, if you decide to change the polling frequency, be aware that the polling frequency affects Probable Cause Analysis.
Probable Cause Analysis does not display events that are outside the specified timeframe before or after the result event. For example, if the default time correlation filter of one hour before the event and 30 minutes after the event is being applied and the polling frequency is 45 minutes, then too few data points are available within the default period to reliably pinpoint the probable cause.
A greater number of data points increases the likelihood of success of the Pobable Cause Analysis process. Therefore, it is best to configure the smallest polling interval that does not affect the performance of the device.
To ensure a reliable baseline for a monitor, the monitor must be collecting data consistently for at least a week. The longer the monitor has been collecting data, the more reliable the Probable Cause Analysis process becomes.
The following types of threshold settings impact the Probable Cause Analysis process:
For external events to be analyzed based on global relationships, set the mc_event_subcategory
slot for each external event. For information about the mc_event_subcategory
slot, see MC_EVENT_SUBCATEGORY enumeration.
When you perform Probable Cause Analysis on an event and find a pattern that you want to reuse in the future, capture it by creating a knowledge pattern. Once a knowledge pattern is available, BMC ProactiveNet immediately applies this pattern to similar conditions and does not perform Probable Cause Analysis all over again.
2 Comments
Franz Finke
Sanjay Prahlad