Information Event value to trigger correlation rule

Solved1.32K viewsCorrelation rule information events
2
0 Comments

Hi Dojo,

I am trying to use the value of an information event to trigger a correlation rule.

Tried a saved filter on the value of an information event and also tried an alarm filtering with severity “information”. However, no success with any of the tried approaches.

Can you give a basic hint on how to convince a correlation rule to be triggered by an information event?

Thanks

Jörg

Marieke Goethals [SLC] [DevOps Catalyst] Selected answer as best 11th July 2023

2 Answers

2
5.03K 1 Comment

Hi Jörg, does the answer on the following question help you?

Parse Information Event – DataMiner Dojo

Kind Regards,

Jarno

Marieke Goethals [SLC] [DevOps Catalyst] Selected answer as best 11th July 2023
Jörg Knesebeck [DevOps Enabler] commented

This helped indirectly because it gave the hint to tick “single event”. Seems like it’s working now. Thanks for all suggestions.
2
1.75K 1 Comment

Hi Jörg,

If you want to use an information event to trigger your correlation rule you need to enable the option “Accept information events”.

Jörg Knesebeck [DevOps Enabler] Posted new comment 20th December 2022
Jörg Knesebeck [DevOps Enabler] commented

Thanks, but actually I have already ticked this option