Configure message correlation

Message correlation helps to prevent your message browser from becoming cluttered by messages that describe the same problem. When message correlation is enabled, you can set the type of duplicate message suppression and define the method used to suppress duplicate messages. Note that for Measurement Threshold and Scheduled Task policies, only the first item (Acknowledge messages with message key) is available.

• Acknowledge messages with message key: If messages with the message key that you type here exist in the active messages browser when this message is received by the management server, these messages are automatically acknowledged. You can use the pattern-matching and variables to match multiple message keys. For example, consider the following pattern:

  <$MSG_SEV>:<$MSG_NODE_NAME>:<_><5*>
  

  This pattern is evaluated by first replacing the variables with the value that they resolve to, for example:

  critical:cabbage.veg.com:<_><5*>
  

  This pattern is then compared—using pattern matching rules—against the message keys for all messages in the active message browser. The pattern above would match the following message keys:

  critical:cabbage.veg.com:	12345
  critical:cabbage.veg.com:  TEST1 
  

  When writing patterns for this box, note the following:
  • Although user-defined variables can be included in this box, these variables can only be expanded after the policy is deployed and therefore are not included in the syntax check that is performed when the policy is saved. Because of this, it is important to ensure that any user-defined variables in this box are correctly used.
  • Pattern-matching test has limited usage because if the 'Patterns to test' contains variable the replacement of those cannot be simulated.

  NOTE:
  For threshold policies, you can specify automatic acknowledgement of messages related to the same policy by using Automatic escalation of threshold levels, set in the Options tab.

Suppress messages which are: This setting lets you choose what kind of messages are considered to be identical.

• Generated by same rule
  Select this option to suppress messages that match the message text pattern specified for the selected rule. This is a more general setting for the suppression of duplicate messages. For example, a logfile entry policy might contain a rule with this match pattern: Error Message<#> The logfile lines Error Message10 and Error Message20 are not identical, but would both match this rule.
• Generated by the same input event. Select this option to suppress messages that were sent in response to two separate events that are identical except for the date and time that the event was generated (for example, identical entries in a log file).
• Identical relative to their attributes
  Select this option to suppress either messages that have the same message key or (if no message key is present) messages that have identical message attributes (except for the date and time that the message was generated).

Suppression Method

For message correlation, you can define one of three correlation methods:

• Time interval: This correlation method lets you define an interval during which duplicate events will be ignored. For more information, see Message suppression simulation for an interactive demonstration of these concepts, or read this detailed example.

  Time interval correlation example

  In the illustration below, the interval is set to 30 seconds, but the suppression is limited to 60 seconds.  

  The  represents events that are identical. 

  1. The first event (E1) matches a rule in the policy.  The policy sends a message and starts timing. 
  2. A second matching event (E2) occurs 25 seconds later.   This event occurred less than 30 seconds after the first event, and is therefore suppressed. 
  3. A third matching event (E3 )  occurs less than 30 seconds after the second event, and so is also suppressed. 
  4. The next matching event (E4) occurs less than thirty seconds after the third event, but is also more than 60 seconds after the first event, and therefore the policy sends a message.
• Counter: This correlation method counts the number of matching events and sends a message only after the number of matching events equals the counter threshold. The counter can also be reset to zero after a time period that you specify. For more information, see Message suppression simulation for an interactive demonstration of these concepts, or read this detailed example.

  Counter correlation example

  

   The  represent events that are identical. 

  1. The first event (E1) matches a rule in the policy, and the counter increments to one.  No message is sent. 
  2. A second matching event (E2 ) occurs, the counter increments to two, a message is sent, and the counter resets.   
  3. A third matching event (E3 ), and the counter increments to one—no message is sent. 
  4. The next matching event (E4) occurs more than thirty seconds after the third event.  Since at thirty seconds the counter was reset to zero, the counter now increments to one—no message is sent.
• Time interval/Counter If you use the Time interval and Counter together, events are evaluated first by the timer. If an event passes the timer, it is then evaluated by the counter, which either suppresses it or sends a message to the management server.

To configure message correlation

1. Right-click the policy and select All Tasks Edit....
2. Select Rules.
3. Select the rule for which you want to correlate messages.
4. Select Modify.
5. Select Actions.
6. Click Message.
7. Select Message correlation.