Unexpected event correlation
Hello MRL experts,
I'm seeing an unexpected behavior with the following MRL rule:
correlate sklAutoBulkCreationDM:
SKL_EV($NEW)
where [
$NEW.CLASS == DATAMINER_EV
AND
$NEW.status == OPEN # Not related to any event
AND
$NEW.skl_sdv_procedureurl == 'dadada'
AND
$NEW.skl_platform_owner == TEST
AND
$NEW.skl_hide_autobulk != YES
]
with SKL_EV($OLD)
where [
$OLD.CLASS == DATAMINER_EV
AND
$OLD.status == OPEN
AND
$OLD.skl_host == $NEW.skl_host
AND
$OLD.skl_sdv_procedureurl == $NEW.skl_sdv_procedureurl
AND
$OLD.skl_platform_owner == $NEW.skl_platform_owner
AND
$OLD.skl_hide_autobulk != YES #Not hidden because of an existing AUTOBULK
]
within 1 m #M parameter of the requirements
when $NEW.event_handle #Static
{
concat (['[AutoBulk] ',$OLD.mc_host,' is ',$OLD.severity], $MSG);
generate_event (AUTOBULK_EV, [ mc_host = $OLD.mc_host, mc_object = 'multiple', mc_parameter = 'multiple', severity = $OLD.severity, mc_priority = PRIORITY_2, msg = $MSG, skl_sdv_procedureurl = $OLD.skl_sdv_procedureurl, skl_sdv_service_group = $OLD.skl_sdv_service_group, skl_sdv = 'Yes', skl_assigned_group = $OLD.skl_assigned_group, skl_owner_group = $OLD.skl_owner_group, mc_service = $OLD.mc_service, skl_sdv_event_visibility = $OLD.skl_sdv_event_visibility, mc_tool='TrueSight (event.lan)',skl_platform_owner=$OLD.skl_platform_owner, mc_host_class=$OLD.mc_host_class, mc_tool_suggestion='multiple Impacted Services', itsm_company=$OLD.itsm_company, itsm_category=$OLD.itsm_category, itsm_type=$OLD.itsm_type, itsm_item=$OLD.itsm_item, itsm_operational_category1=$OLD.itsm_operational_category1, itsm_operational_category2=$OLD.itsm_operational_category2, itsm_operational_category3=$OLD.itsm_operational_category3]);
#trace operation
concat(['EV#',$NEW.event_handle,' was automatically related to EV#',$OLD.event_handle,' and triggered the creation of a new AutoBulk event'],$DETAIL);
opadd($NEW,'',$DETAIL,'');
unset_cause; # After the creation of the AUTOBULK_EV the relationship between the 2 events is no longer needed
}
END
The expected behavior is to see an AUTOBULK_EV created when the second DATAMINER_EV arrives and gets correlated to the first DATAMINER_EV if the second one arrived within 1 minutes from the arrival of the first one.
What I'm seeing instead is...
Event 2 correlated to Event 1 creating Event 3 (AUTOBULK_EV)
+
Event 1 correlated to Event 2 creating Event 4 (AUTOBULK_EV)
So I have the creation of an additional AUTOBULK_EV, which is not expected. I believe the correlation between Event 1 and Event 2 (the second correlation) should not happend.
In the test environment I have never seen this unexpected behavior and the rule used in the production environment is the same... :-s
Could anyone see the issue which is causing this unexpected behavior?
Unfortunately I don't have the issue traced in cell logs because, if I enable the cell tracing, the issue disappears, so it's a quite weird investigation...
Product version: TSIM 10.7 patch 3.
Thank you in advance for your help.
Kind Regards,
Alvaro Paronuzzi
