Correlation Composer for HP OpenView Operations

Correlation Composer for

HP OpenView Operations

Stefan BergsteinAnish Joseph

OpenView SoftwareJune 2003

page 211/29/2014 Correlation Composer for OVO

OV Correlation Composer Overview

Correlation Composer enables you to:

• Specify correlation logic for simple to complex problems including root cause analysis

• Use pre-packaged Correlator Templates to define commonly occurring correlation logic


Correlation Composer’s Components

Composer Circuit

ECS Engine

• GUI environmentto specify correlation requirement(s)

• Runtime Componentused to implement correlation


Correlations in OVO

Suppression of messages• timer• counter• combination of both• message conditions• agent

Smart Message correlation• message counter in browser • built-in pair-wise correlation• defined via message key and

relations• persistence message handling • server based

Event Correlation (ECS)• very sophisticated• additional product• supports complex scenarios• agent and server correlations

Correlation Composer• supports 6 standard correlation

scenarios• much easier to use that ECS

Designer• integrates external data into the

correlation • extendable with Perl• agent and server correlations


OV Correlation Composer

Why do we need an additional correlation tool?

– Out-of-the-box Correlation for “well known” problems

– Quickly & easily customizable

– Ability to easily and quickly extend functionality

– Ability to easily use external data for correlation

– Technology and domain independence


Correlation Design Process (ECS Designer)

Output:

1. OS Correlation circuit

2. DB Correlation circuit

3. Network Correlation circuit

RequiresDomain & Technical Knowledge

DB & ECSExpert

Network & ECS Expert

ECS Designer

Expert Designs Circuit in ECDL

ECS Engine

Test & Debug Cycle

OS & ECS Expert


Composer Correlation Design Process

Correlator TemplatesCorrelator DB

Output

1. OS Correlator

2. DB Correlator

3. Network Correlator

ECS Engine

Expert Configures Correlator(s)

Composer GUI

OS

DB

Network


Correlation Composer Concept

ECS Engine

ECS Circuit •Out-of-the-box ECS Template and circuit

implements the Correlator Templates

Rate

Transi

ent

Suppre

ss

Enrich

Repeate

d

Multi

-sourc

e

Use

r-defined

correlation definition

configuration GUI

circuit

Correlator Templates•Defined models used to build correlation

definitions.

Correlators •Defines the instances of the correlation

templates used in the correlation definition•Defines the default parameters and values for

the correlation templates

Correlation Composer•New easy mechanism to configure and customize

correlation definitions•New easy mechanism to create new correlation

definitions

ECS Engine •Embedded in OVO Server and agent


Correlator Templates Overview (1)

Enhance • modify/enrich messages

Multi-Source

• define a relationship between messages

• discard/modify a subset of messages

Rate • measure the number of msgs occurring within a specified period.

• discard all msgs and emit only the newly created msg


Correlator Templates Overview (2)

Repeated • duplicate messages received within a time window are discarded

Suppress • is used when a specific category of msgs needs to be discarded.

Transient • detect transient failures and on detection discard both the msgs.

User-Defined

• is used when none of the other correlator templates meet the correlation requirement.


Using composer with OVO

• Prepare your management server or agent system

• Developing Correlators with the OV Composer UI

• Install Correlators to your management server or agent system


Composer ECS Circuit

• Circuit implements the pre-defined Composer Correlation logic

• configured via a Correlator Store (a fact store)

• Runs on OVO agent or server


OVO Applications for OV Composer

• Start Composer UI

• Install Correlators on Agent

• Install Correlators on Server


Correlation composer integration

OVO Admin

ECS runtimeopcecm/a

<<process>>

Composer Circuit

ecs_comp.eco<<circuit>>

Correlatorsecs_comp.fs

<<factstore>>

OVO ECtemplates

ec

Correlator Composer UI

activate

ecsmgr<<command>>

Messages

OVO Message Browser

Correlatorsmy_work.fs

<<factstore>>

save

merge, rename, & copy

update1

2

3

OVO app“start ui”

OVO app“install”


ovocomposer(1) - perform tasks related to OV Composer

Start the Correlation Composer UI:

ovocomposer -ui

Install Correlator store(s) on OVO Management Server:

ovocomposer -install \

[ -fs fstore1 [ -fs fstore2 ... ] ] -ms

Install a Correlator store(s) on OVO agents:

ovocomposer -install \

[ -fs fstore1 [ -fs fstore2 ... ] ] \

-agt node1 [ node2 ... ]


Directories, files, man pages

Central Correlator store directory on the OVO Server:/etc/opt/OV/share/conf/OpC/mgmt_sv/CO/

Correlator store with OVO specific constants:/etc/opt/OV/share/conf/OpC/mgmt_sv/CO/empty.fs

Directory for files which contain Perl callback functions:/opt/OV/contrib/ecs/external/perl/

For further information see:ovocomposer(5), ovocomposer(1)


Examples

• Multi-Source - Combine an DB and OS messages

• Enhance – Enrich message using Perl


Multi-Source - Combine an DB and OS messages (1)

Correlation requirement:•add probable cause “Filesystem is full” to msg

text of ORA msg•add filesystem oper-action to ORA msg

Filesystem <fileys> is full

ORA-2820: Unable to write the requested number of blocks.

Messages

oper-action: bdf <filesys>

ORA-2820: Unable to write the requested number of blocks. Probable cause: Filesystem /u01/oradata/ is full.

oper-action: bdf <filesys>


Multi-Source - Combine an DB and OS messages (2)


Enhance – Enrich message using Perl (1)

Correlation requirement:•call getHostInfo(msg_node_name)•add return value to message text

Any Message text

Messages

Any Message text: Info from Perl function

sub getHostInfo {

local($nodename)=@_;

local($infile) ="/etc/hosts";

local($line);

if (!open (INFILE, "<$infile")) { … }

while (<INFILE>)

{

$line = $_;

if( $line =~ /$nodename.*\#(.*)/ )

{ return " $1"; }

}

return " ";

}


Enhance – Enrich message using Perl (2)