Filtering event display for All Abnormalities in the operator console

Note

The Infrastructure Management Administrator can set up specific user-defined rules that can help you keep track of frequent alarms and their causes. For instance, if you continually receive an alarm and you realize that the alarm is triggered by a recognizable pattern, you can set up rules that replace Infrastructure Management probable cause description with specific information related to that alarm. In other words, you can override Infrastructure Management's generic probable cause information by attaching a rule to a specific abnormality that adds known information and domain knowledge into the system.

Related topics

Using-the-operator-console-to-complete-IT-Operator-goals 

Monitoring-and-managing-events-from-the-operator-console

You can filter events using the criteria listed in the following table by selecting the Grid view instead of the default Event View on the All Abnormalities screen. These filters correspond to probable cause analysis only.

Filter options on All Abnormalities screen

Filter option

Description

Status

Choose the status of the events you want to see. The menu lets you choose either all open, open, acknowledged, assigned, blackout, closed, or no filter.

Time

Time boundary of the event or event selected for probable cause analysis. This link displays all time-correlated events that occurred during the period. 
Input the following to specify the period:

  • Minus: Start time of the period; time of the event or event selected for the probable cause analysis - time selected in minutes.
  • Plus: End time of the period; time of the event or event selected for the probable cause analysis + time selected in minutes.

All events that occurred during this time range are queried for probable cause based on the Smart Filter check box selection. The Time Filter on probable cause Analysis page does not filter based on the selected time range (even though the filter results heading indicates the time range). This is 'as designed'. By default, if you are doing probable cause analysis on a non-availability (up or down) problem, then events or events that were opened up to 24 hours ago are included, as long as they are still open in the time window the user specified. 
This is configured in installationDirectory/usr/pronto/conf/pinpoint.conf filterRules.TimeFrameForPastOpenEvents=86400. 

This design accommodates degradation issues resulting from something that happened several hours earlier. For example, if a process starts using an abnormal amount of memory at 10:00 A.M. and memory usage continues to grow to the point, that at 4:30 P.M., it affects some transactions to that device.

Device Name

Specify the device name (already set up) to view corresponding records.

Group

Select a group from the list to limit the displayed records to those that are associated with the group.

Monitor Category

Select a monitor category by which to filter one of the following: user transactions, application, network, system, or database.

Score

Indicates how closely the event relates to the probable cause of the problem 
Each event listed in the table is given a score between zero and 100 percent, indicating the possibility that this event is the cause of the problem. The percentage is determined by applying a Smart Filter Algorithm to the event and calculating the score value.

Smart Filter

Select this option to apply Smart Filters (built-in Probable Cause Analysis algorithm to find out the most probable cause). This filter limits events to a selected set based on the type and other attributes. If you clear the check box, Infrastructure Management displays all events that occurred during the selected period. For information, see To set the filter criteria.

Note

Infrastructure Management supports the following relationships:

  • Service to service 
  • Service to group 
  • Group to group 
  • Group to service 
  • Service to device 
  • Group to device
     The service definition is always maintained as the source of the relationships. For example, when you search for an abnormality based on service name it also displays direct impact abnormalities in the underlying relationships.

To set the filter criteria

  1. Click Edit to set the filtering criteria.
  2. Select one of the following options to apply filter criteria:
    • Show all events for each monitor instance
    • Show one event per attribute for each monitor instance
    • Show only top scored event for each monitor instance
  3. Select the Save as default option if you want to set current setting as default filter criteria.
  4. Click Apply.

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*