Performing probable cause analysis on an event from the TrueSight console

By gathering data from different sources and applying filters to rule out unrelated events, BMC TrueSight Infrastructure Management can determine the most likely causes for an event, such as an attribute that is outside the valid range. This process of gathering and filtering data to determine the cause for an event is called probable cause analysis.

The probable cause analysis process analyzes data and displays the relevant events automatically. You can increase the accuracy of probable cause analysis by providing relationships between devices and monitors. The more data you provide about an event, the more accurate the results of the probable cause analysis will be.

To perform probable cause analysis on an event, the event should be associated with a device. If not, no related events are displayed.

This topic provides the following information:

• • To perform probable cause analysis on an event
  • To change the probable cause analysis settings
  • Related topics

To perform probable cause analysis on an event

1. From the Events or Event Details page, click the action menu for the event on which you want to perform probable cause analysis.
2. Select Probable Cause Analysis.

3. Choose the options that help you to narrow down or broaden your criteria:

   

   1. Analysis focus (2)
      

      You can choose from four different levels. You can even customize these levels.

      Level 1 gives you the most related events, while level 4 broadens your criteria and includes a wider range of events.

   2. Time range (3)
      

      Drag the slider to select the time interval, before and after the event.

   3. Groups filter (4)
      You can add certain groups and only those groups will be considered for the probable cause analysis.
4. Click Analyze to start the probable cause analysis.
   A list of probable events is displayed, based on the criteria you selected.

To change the probable cause analysis settings

1. Select the action menu (1) next to Probable Cause Analysis and select Edit Analysis Settings.

2. Change the settings, described in the following table, to meet your requirements:

   Field	Description
   Default View	Sort by Score: Displays the events sorted by the score. Sort by Device: Displays the events sorted by devices of the events.
   Data Correlation	Correlates data using the data collected for the resulting event and the probable cause event. Data correlation is applicable only to intelligent events.
   Correlate Metric Data	Correlates the metric data of the primary event against the metric data of each candidate event. Only the metric data within the analysis window is analyzed. For example, if you select - 1 hour and + 1 hour in the time window slider, up to 2 hours of data are analyzed.
   Correlate Metric Data with Previous Abnormalities	Correlates data between the metric of the primary event against other metrics for the time periods at which the primary metric was abnormal in the past (subject to data retention limits.) This setting can produce more accurate data correlation results at the cost of increased processing time. However, the results might take up to 3 times longer to return.
   Set as Default Filter Level	Select the filter level to set as the default and select this checkbox. To customize a filter level, select the filter level, make the necessary changes, and click Save. The  icon indicates that the filter level has been customized.
   Exclude Events for Non-KPI Metrics	Select this option to exclude events by non-Key Performance Indicators (KPI).
   Include Only Highest Scoring Event Per Metric	Select this option to display only the event with the highest score, in case there are multiple secondary events for the same monitor instance.
   Include Events in Primary Event's Application Models	Select this option to include events from the application models associated with the primary event.
   Include Events in Primary Event's Service Models	Select this option to include events from the service models associated with the primary event.
   Include Events Matching Global Relationships	Select this option to control whether the built-in global relationships are used to determine probable cause.
   Exclude Events Not Associated With a CI	Select this option to exclude an event that is not associated with a device or a CI.
   Include Events Scoring More Than	Select this option to include events with a score higher than that entered in this field. After the probable cause analysis identifies the probable cause events, each event is scored and only the events whose score is above the specified limit are shown as root cause in the probable cause analysis page.

3. Click Save to save the settings or Restore Defaults to restore the default settings.

Related topics

Viewing-event-details-in-the-TrueSight-console

Cross-launching-from-the-TrueSight-console-to-TrueSight-IT-Data-Analytics

Probable-Cause-Analysis