I need to create a correlation rule that sends an email when two parameters of two diferent elements have an active critical alarm.
What would be the best approach for implementing this, considering that the two elements are not part of the same view or service?
Hi Daniela,
You should be able to configure this as follows:
Alarm Filter:
- Element X Critical
- OR
- Element Y Critical
Alarm Condition
- Filter Condition - Element X Critical
- AND
- Filter Condition - Element Y Critical
The "Alarm Filter" will cause Correlation to continuously keep track of the collection of currently active critical alarm trees on element X and element Y.
The "Alarm Condition" will make it so that the "bucket" of alarm trees as kept track of by correlation will not trigger any actions unless there is at least one critical alarm on element X and one critical alarm on element Y.
If both elements are hosted on the same agent, that's all you need. If the elements are hosted on different agents, you'll also need to enable the "correlate across DMAs" option in the "Show Details" part of the "GENERAL" section.