Cisco Cisco Prime Collaboration Assurance 11.5 White Paper

 

 

© 2015 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information. 

Page 3 of 14 

Introduction 

Cisco Prime

™

 Collaboration Assurance 10.5 and higher provides you with an extensible correlation engine. This 

engine can be used to correlate the events reported on your Cisco

®

 collaboration network based on rules. Event 

correlation streamlines dependent events into fewer alarms, and the Cisco Prime Collaboration Assurance event 

correlation engine helps reduce the clutter of events and alerts on dashboards. Users can easily see key alerts and 

events on the alarm browser and can take action to fix them, improving mean time to repair (MTTR). Event 

correlation offers built-in rules to correlate data and generate aggregated alerts. 

You can embed the correlation intelligence in the form of rules using pure SQL without the need to write any Java 

or C++ code. 

Cisco Prime Collaboration Assurance offers three kinds of correlation rules - time-based correlation, threshold-

based correlation, and root-cause correlation. 

The following use cases describe how to implement the custom correlation rules using the correlation engine. 

Use Case 1: Repeated Occurrence 

Assume there are call failures in your collaboration network. Whenever a call routing through a particular route list 

(RL) fails due to resource exhaustion, a RouteListExhausted alarm is raised. If you do not wish to be notified on 

every failure, you can use the correlation engine to create a simple rule that raises an alarm when a definitive 

failure event occurs. For example, you can create a rule to raise an alarm when 10 failures occur in a span of five 

minutes. 

You can create a rule using the correlation engine as follows: 

1.  Log in as globaladmin to the Cisco Prime Collaboration Assurance application, and navigate to 

Administration > Alarm & Event Setup > Event Customization. 

2.  Click Add in the Correlations Rules tab. In the popup window, specify: 

a.  Rule name; for example, Repeated RL Failure Rule. 

b.  Correlation alarm name that must be raised when the rule condition is satisfied; for example, Repeated 

RL Failure. 

c. 

Description for the alarm; for example, “This alarm would be raised when multiple RL failures happen 
within a short span of time”. 

d.  Severity for the correlated alarm; for example, Critical. 

e.  The rule: 

select deviceid, source as componentname, array_accum(id) as ids from 
cpcm_schema.allfaultevent_stream < VISIBLE '5 minutes' ADVANCE '1 minute' > 
where name='RouteListExhausted' group by deviceid, source having count(*) >= 
10; 

3. 

Click Save.