Page tree

Unsupported content


This version of the documentation is no longer supported. However, the documentation is available for your convenience. You will not be able to leave comments.

By gathering data from different sources and applying filters to rule out unrelated events, BMC TrueSight Operations Management can determine the most likely causes for an event, such as an attribute that is outside the valid range. This process of gathering and filtering data to determine the cause for an event is called probable cause analysis.

The probable cause analysis process analyzes data and displays the relevant events automatically. You can increase the accuracy of probable cause analysis by providing relationships between devices and monitors. The more data you provide about an event, the more accurate the results of the probable cause analysis will be.

To perform probable cause analysis on an event, the event should be associated with a device. If not, no related events are displayed.


 Export the event and check the value for mc_host_id. A value of zero indicates the event is an external event and no related events are displayed.

This topic provides the following information:

To perform probable cause analysis on an event

  1. From the Events or Event Details page, click the action menu for the event on which you want to perform probable cause analysis.
  2. Select Probable Cause Analysis.
  3. Choose the options that help you to narrow down or broaden your criteria:

    1. Analysis focus (2)

      You can choose from four different levels. You can even customize these levels.

      Level 1 gives you the most related events, while level 4 broadens your criteria and includes a wider range of events.

    2. Time range (3)

      Drag the slider to select the time interval, before and after the event.

    3. Groups filter (4)
      You can add certain groups and only those groups will be considered for the probable cause analysis.
  4. Click Analyze to start the probable cause analysis.
    A list of probable events is displayed, based on the criteria you selected.


The KPI information for legacy Infrastructure Management monitors is not available in the Presentation Server. As a result, when you perform probable cause analysis on such events at analysis focus level 1, no related events are displayed. Choose focus levels 2, 3, or 4 to view related events.

To change the probable cause analysis settings

  1. Select the action menu (1) next to Probable Cause Analysis and select Edit Analysis Settings.
  2. Change the settings, described in the following table, to meet your requirements:


    Default View

    • Sort by Score: Displays the events sorted by the score.
    • Sort by Device: Displays the events sorted by devices of the events.

    Data Correlation

    Correlates data using the data collected for the resulting event and the probable cause event. Data correlation is applicable only to intelligent events.

    Correlate Metric Data

    Correlates the metric data of the primary event against the metric data of each candidate event. Only the metric data within the analysis window is analyzed.
    For example, if you select - 1 hour and + 1 hour in the time window slider, up to 2 hours of data are analyzed.

    Correlate Metric Data with Previous Abnormalities

    Correlates data between the metric of the primary event against other metrics for the time periods at which the primary metric was abnormal in the past (subject to data retention limits.) This setting can produce more accurate data correlation results at the cost of increased processing time. However, the results might take up to 3 times longer to return.
    Set as Default Filter Level

    Select the filter level to set as the default and select this checkbox.

    To customize a filter level, select the filter level, make the necessary changes, and click Save.

    The  icon indicates that the filter level has been customized.

    Exclude Events for Non-KPI MetricsSelect this option to exclude events by non-Key Performance Indicators (KPI).
    Include Only Highest Scoring Event Per MetricSelect this option to display only the event with the highest score, in case there are multiple secondary events for the same monitor instance.
    Include Events in Primary Event's Application ModelsSelect this option to include events based on the impact relationships defined for the CI associated with the primary event.
    Include Events Matching Global RelationshipsSelect this option to control whether the built-in global relationships are used to determine probable cause.
    Exclude Events Not Associated With a CISelect this option to exclude an event that is not associated with a device or a CI.
    Include Events Scoring More ThanSelect this option to include events with a score higher than that entered in this field. After the probable cause analysis identifies the probable cause events, each event is scored and only the events whose score is above the specified limit are shown as root cause in the probable cause analysis page.
  3. Click Save to save the settings or Restore Defaults to restore the default settings.

Related topics

Viewing event details

Cross-launching to BMC TrueSight IT Data Analytics

Performing probable cause analysis in Infrastructure Management Open link