I have a correlation rule for iLO/iDRAC issues spanning across multiple sites. We have 8 DMAs in a cluster and each DMA is responsible for that site's elements. Each site has it's own correlation rules looking for alarms. All sites have the same rules, they're just looking at different views or elements.

On the correlation rule, I have the alarm filter section looking at a specific View (IS) (all that sites elements are under that root view) which then filters only elements using the (AND) iLO or (OR) iDRAC protocol. In the rule condition I'm looking for any (IS) critical severity.

The problem is when this correlation rule is triggered, it's being triggered at all 8 sites instead of just that one so all 8 locations get an email for that sites alarm. What looks to be happening is it's either ignoring or not correctly evaluating the Alarm Filter section. It's being triggered on the correct elements and alarms, I just don't understand why when it does get triggered, it's triggering on all 8 DMAs even though the other correlation rules are looking at different views.