0 Replies Latest reply: Apr 15, 2012 4:47 AM by valery NameToUpdate RSS

    Correlation Rule using DDM

    valery NameToUpdate

      Hi Guys,


      Two questions:


      1. Is it possible to correlatewhere both cause and effect are EVENT and use a DDM table wherein the 'where' clause we choose the actual slots that define the correlation ?



      correlate load : EVENT ($EFFECT)

      with EVENT ($CAUSE)

      using {CORRELATION_CONTROL($CC)where [

             $CC.effect_class ==  $EFFECT.CLASS,

             $CC.effect_source == $EFFECT.source,

             $CC.cause_class == $CAUSE.CLASS,

             $CC.cause_source == $CAUSE.source,

             $EFFECT.hostname == $CAUSE.hostname


      within 24 h

      when ....


      2. What would be cell coston a very busy cell ?