The rule in my example is configured like this:
The primary is basically the root cause, and the primary are the effected alerts. Another example: "Printer offline" is the primary, and "Print job failed" is secondary. The print job failed events are generated because of the printer offline (root cause).
Hope that answers your question.
Alert Correlation is a way to group alerts together based on criteria, with primary and secondary alerts. The purpose is to provide a better overview of the alerts.
An example: A VMware host goes offline, which generates hundres of messages about the VMs on the host:
Now i create an alert correlation based on Source (=VMware), Type (=Connection) and Resource (=Power). The next time this happens, they will be grouped into Primary and Secondary:
If you then enable Correlated Alerts in the upper right corner, they will collapse as a group:
I hope this answers your question with a real time example.
The rule in my example is configured like this:
The primary is basically the root cause, and the primary are the effected alerts. Another example: "Printer offline" is the primary, and "Print job failed" is secondary. The print job failed events are generated because of the printer offline (root cause).
Hope that answers your question.
