Writing IBM correlation rules

Prerequisites

  1. Plan for event correlation
  2. Design the rules to correlate events
  3. Create a symptom database, or Import a symptom database then Edit a symptom database

Procedures

The Symptom editor opens when you are creating or editing a symptom database. You can then create rules and rule blocks in the Symptom Definitions view of the Symptom editor.

When creating rules, except for the Timer Rule, you can select the events for correlation.

As you are creating rules, you can save and compile them.

Tip: For guidance on how to create a symptom database and write symptom definitions, complete the tasks in the Creating a Symptom Database cheat sheet. To open this cheat sheet:

  1. From the main menu bar, click Help > Cheat Sheets.
  2. Expand Log and Trace Analyzer and click Creating a Symptom Database.
  3. Click OK.

Creating rules

To create a rule:

  1. In the Symptom Definitions view, right-click Catalog and click New > Definition.
  2. Right-click Definition and click New > Rule.
  3. Right-click Rule and click New > <act_rule> where <act_rule> is one of the following IBM(R) correlation rules: See the links in the Related reference section below for information on each rule pattern.
Remember: The Timer Rule and the <timeWindow> element are ignored by Log and Trace Analyzer. The <timeWindow> element is contained in all the IBM correlation rules except for the Filter Rule. The time period for collecting events, specified in the Pattern Specifics tab, should always be set to Collect events as long as this rule is active.

Creating rule blocks

To create a rule block:

  1. In the Symptom Definitions view, right-click Catalog and click New > Definition.
  2. Right-click Definition and click New > Rule.
  3. Right-click Rule and click New > Rule Block.
  4. Optional: To create rule blocks within rule blocks, right-click Rule Block and click New > Rule Block.
  5. Right-click Rule Block and click New > <act_rule> where <act_rule> is described in the Creating rules section above.
  6. Optional: To create additional rules within a rule block, repeat step 5 for each rule within the rule block.
Limitation: Do not create a Filter Rule within a rule block. Only create a Filter Rule within a rule.

Selecting events

To select events for correlation:

  1. Click the Event Selection tab of an IBM correlation rule. This tab is not available for the Timer Rule.
  2. Specify the event type:
    1. Click Add.
    2. In the Event definition provider field, select LogAndTraceEventProvider.
    3. In the Event types field, expand Event Types and select a type; or enter another event type in the New event type field.
    4. Click OK.
  3. Specify the expression:
    1. From the main menu bar, click Window > Show view > Snippets.
    2. In the Snippets view, click the Log and Trace Analyzer event processing category to see the snippets in that category.
    3. Select the snippet to include in an expression.
    4. Click and drag the snippet into the Expression field. The code is inserted at the position of the cursor in the Expression field. If prompted, provide input to the code before it is included in the expression.
    5. Optional: Modify the code in the Expression field.

Saving and compiling rules

To save and compile rules in the Symptom editor:

  1. From the main menu bar, click Window > Show View > Problems to see the Problems view.
  2. From the main menu bar, click File > Save to save and compile the rules. The Problems view displays errors that occurred during compilation.

Related concepts
Rule language overview

Related tasks
Planning for event correlation
Designing the rules to correlate events

Related reference
Summary of rule set organization
Language element reference