Create an RCA configuration

Service Analytics uses an RCA configuration to determine which set of alerts from the sa_analytics_alert table to use for RCA. You can create a custom rule-based RCA configuration, compare it with another RCA configuration and decide how efficient and helpful it is. You can then choose the RCA configuration that is most suitable in your environment, and configure RCA to use that configuration in its analysis.

Before you begin

Role required: evt_mgmt_admin

About this task

Each rule-based RCA configuration consists of one or more rules. If an RCA configuration has multiple rules, then the rules' filters are applied to alerts according to their priority order.

If the Domain Support - Domain Extensions Installer plugin is activated, then alerts are processed according to the domain of the associated business service.

Procedure

  1. Navigate to Event Management > Service Analytics > RCA Configs
  2. Click New, and fill out the SA RCA SMC Config Base form.
    Table 1. RCA Configuration form
    Field Description
    Name Configuration name.
    Description Description for the configuration.
    Domain Domain that this configuration applies to.
    Config deployed Read-only field, which is automatically computed by the system. It is selected (true) if at least one version of the configuration has been deployed.
    Created Date and time that this configuration was created.
    Created by User that created this configuration.
    Updated Date and time that this configuration was updated.
    Updated by User that updated this configuration.
    Model The model to use for the configuration. Typically, the model that is used for a custom RCA configuration is Rule Based.
  3. Right-click on the form title, and click Save.
  4. Add rules to a rule-based RCA configuration:
    1. Click SA RCA SMC Rule Bases at the bottom of the form.
    2. Click New, and fill out the form.
      Table 2. RCA Configuration form
      Field Description
      Name Name of the RCA configuration rule.
      Description Description of the RCA configuration rule.
      Configuration id The RCA configuration that this rule is associated with.
      Order An integer that represents the priority of the rule within the rest of the rules for the configuration. Lower numbers have higher priority.
      Created by User name.
      Created Time created.
      Updated by User name.
      Updated Time updated.
      Domain Domain that this rule applies to.
      % Alert Coverage System generated percentage of alerts in the sa_analytics_alert table that match the rule's filter.
      Rule filter Conditions to filter alerts for this rule.
  5. Select the check box for the new rule and click Alert Coverage to calculate the rule's % Alert Coverage.

What to do next

  • Compare the new RCA configuration with another configuration, and decide which configuration is most helpful and should be deployed in the next RCA Learner cycle.
  • After modifying a configuration, or when there is a significant number of new alerts, select any rules and click Alert Coverage. This recalculates the % Alert Coverage for the selected rules.