Event Correlation and Precedence

SL1 allows you to create parent-and-child relationships and define event correlations. SL1 will create parent and child devices automatically when:

SL1 discovers Layer-2, CDP, LLDP, Layer-3, and legacy VMware topology.
SL1 performs collection for Dynamic Applications that create component devices or device relationships.

You can also create parent and child links manually. Once parent and child devices have been created, you can define suppressing and suppressible events.

Use the following menu options to navigate the SL1 user interface:

To view a pop-out list of menu options, click the menu icon ().
To view a page containing all of the menu options, click the Advanced menu icon ().

Event Correlation

In SL1, event correlation means the ability to build parent-child relationships between events. When events are correlated, only the parent event is displayed on the Events page. The child events are rolled up under the parent event and are not displayed on the Events page. For the parent event, the count column will be incremented to indicate the number of correlated child events.

You can define parent-and-child relationships for devices and for the events associated with those devices. When suppressing and suppressible events are defined, selected events on the child device (or children devices) will be rolled-up under the parent device's events on the Events page.

For example:

Suppose you have a device named "cat-5505". Suppose this device is a switch. Suppose we define this switch as a parent device.
Suppose we have a device named "server001". Suppose this device is a server that is attached to the switch. Suppose we define this server as a child device to "cat-5505".
Suppose we define the event "Poller: Interface operationally down" as a suppressing event.
Suppose we define the event "Poller: Device not available via SNMP or ICMP" as a suppressible event.
If the interface goes down on the switch "cat-5505", SL1 will not be able to communicate with the server, "server001", attached to the switch.
So if the event "Poller: Interface operationally down" occurs on "cat-5505", the event "Poller: Device not available via SNMP or ICMP" will be suppressed on "server001". In the Event Monitor page, only the event "Poller: Interface operationally down" on the device "cat-5505" will appear.

To define event correlation, you must define parent and child devices, and define a hierarchy between events. In Topology maps, SL1 can automatically define parent and child devices. For example, if SL1 discovers a switch and its clients, SL1 automatically defines the switch as the parent device and its clients as the children devices.

You can also manually define parent and child devices when you create Layer-2 links, Layer-3 links, CDP links, LLDP links, or Event Correlation Override links.

To manually define parent and child links in Customized maps:

Go to Maps > Classic Maps > My Customized Maps and select a customized map you want to view. In this example we will use a customized map that does not have links defined.

To create a parent-child link between two devices, select the Edit: Links button. Create a link for two devices by clicking first on the device you want to be a parent, and then click the device you want to be the child. In this example, we will create an Event Correlation Link.
A link is created, and the Link Editor appears.

The Link Editor allows you to perform the following actions:

Device. Displays the name of the device at one end of the link. You can specify whether this device is a parent, sibling, or child (as compared to the other end of the link). A sibling relationship affects only the display of the map when the default arrangement options are used; the two devices will be on the same horizontal plane in the tree view or the same distance from the center point in the radial tree view.
Device. Displays the name of the device at the other end of the link. You can specify whether this device is a parent, sibling, or child (as compared to the other end of the link).

Link Color. Specifies how SL1 should color-code the link. The link can use either interface state or device state. Interface state reflects the event with the highest severity that is aligned with the interface. Device state means the event with the highest severity that is aligned with the device. Choices are:

Auto (Interface State then Device State). This is the default setting. If possible, SL1 will first use the interface state to color-code the link. If SL1 cannot determine the interface state, SL1 will use the device state to color-code the link. If you select Parent and Child in the Link Color Source field, each end of the link can have a different color.
Interface State. SL1 will first use the interface state to color-code the link. If you select Parent and Child in the Link Color Source field, each end of the link can have a different color.
Device State. SL1 will use the device state to color-code the link. If you select Parent and Child in the Link Color Source field, each end of the link can have a different color.

NOTE: If all or part of a link are white, this means that SL1 could not determine the interface state or device state for that end of the link.

Link Color Source. Specifies whether SL1 will display the status of both interfaces or only one interface when displaying link status. Choices are:

Parent and Child. This is the default setting. Half the link will display the parent status and half the link will display the child status.
Parent Node Only. The link will be color-coded to display only the parent status.
Child Node Only. The link will be color-coded to display only the child status.

Label Source. Specifies whether or not to include a label with the link and if so, the information to use in the label. Choices are:

Disabled. This is the default setting. SL1 will not include a label with this link.
Auto (based on relationships). Based on what information is available, SL1 will automatically select the label source that provides the most information.
Parent Interface Utilization. Specifies the label will display the utilization of the percent interface.
Child Interface Utilization. Specifies the label will display the utilization of the child interface.
Combined Link Utilization. Specifies the label will display the combined utilization of the percent and child interfaces.

Label Scale. Allows you to set the size of the text box and text of the label in relation to the size of the link. You can use the slider to choose scale between 50 % to 300%.
Show Relationships. Displays the Node Relationships pane, where you can define and edit the link.

In the Node Relationships pane, select Convert Relationship To. Select Event Correlation Override. You have the following options:

Device. Displays the name of the device at one end of the link. You can specify whether this device is a parent, sibling, or child (as compared to the other end of the link). Editing the parent/sibling/child setting in this field also changes the setting in the Device field.
Device. Displays the name of the device at the other end of the link. You can specify whether this device is a parent, sibling, or child (as compared to the other end of the link). Editing the parent/sibling/child setting in this field also changes the setting in the Device field.

After parent and child relationships have been established, you can define a hierarchy between events—that is, define parent events (called suppressing events) and child events (called suppressible events). For details on defining a hierarchy between events, see the section on Events.

Precedence

In some instances you might have multiple parent-child links between two devices. SL1 displays only one of the relationships. SL1 gives precedence to showing these relationships in the following order:

Manually defined event correlation links
Layer-3 links
CDP links
Layer-2 links

Additionally, any manually created, edited, or deleted layer-3, CDP, and layer-2 links take precedence over the information discovered by SL1. The changes are propagated to discovery and event correlation.