hp OpenView event correlation services (ECS) for network node ...

hp OpenView
event correlation services
(ECS) for network node
manager and operations
product brief
pinpointing the source of problems
HP OpenView Event Correlation Services (ECS) is an advanced
event correlation technology, providing one of the most intelligent
correlation engines to date. ECS is fully integrated with Network
Node Manager to correlate network related events and HP
OpenView Operations to correlate events coming from the
different layers of the environment: the network, systems,
applications, databases and the Internet.
This will give customers the ability to pinpoint the real source
of their problems. So now, when a problem occurs, Network
Node Manager and Operations will filter events coming from the
environment, correlate the event storm and alert administrators to
the real source of the problem.
HP OpenView solutions manage systems and networks and
the information services they provide.
Page 1
see the real problem
The ECS Designer is a powerful product that offers sophisticated
capabilities to create customized rules for specific event correlation
requirements that can be used for Network Node Manager and
Operations. The ECS Designer GUI makes the complex process
of event correlation design intuitive and user-friendly.
getting the most from your investment
HP provides high-quality software services that address all
aspects of your software application life-cycle needs and align
with your business goals. With HP as your partner, you have
access to standards-based, modular, multiplatform software
coupled with HP’s best-in-class services and support portfolio.
HP offers premier onsite deployment assistance and development
support, in addition to consulting, outsourcing, financing,
education, extensive online self-help, and mission-critical support
options. All of these offerings are focused on helping you
maximize the return on your investment.

ECS components
the ECS engine
The ECS Engine, the run-time component of the event subsystem,
transforms and processes event streams according to the installed
correlations. The engine comes for free with every Network
Node Manager and Operations product, enabling out-ofthe-box
correlation. ECS gives you the flexibility to correlate
messages of different event types, such as SNMP, ASCII and
events from every Operations message source. These events
are processed and displayed in a single, consistent format,
independent of event type. Furthermore customers can also
integrate other correlation applications and use them as
an additional information resource or use them to execute
commands as part of the event processing.
the ECS designer
The ECS Designer, which includes both correlation design
and simulation modes, is an easy-to-use GUI that offers a highly
productive, intuitive paradigm to build correlations simply by
interconnecting correlation node primitives.
When the correlation is defined, the ECS Designer can be
switched to simulate mode. In this mode, events can be input into
the correlation to allow visualization of the flow of events through
the system. By using log file events customers can take advantage
of simulating real live scenarios within their environment.
Various techniques are used to feedback data about the correlation
circuit. Events can be input in various configurations, to step
by a particular event, by time, at selectable speeds, or until a
breakpoint. Furthermore, the status of each node can be examined
at any time, all leading to a rich test and debug environment.
integration with network node manager
The customized correlation logics that are created using the
ECS Designer complement the four pre-defined logics that come
free with Network Node Manager. All of the logics (customized
and pre-defined) use the ECS Engine to process the event
stream. Third-party device vendors now have the opportunity
to develop correlation logics for their customers, and deploy
them to any Network Node Manager management station
or collection station. The parameters of the logics can be
customized using the ECS Configuration GUI, leading to
even greater flexibility.
Furthermore, when events are correlated into high-level alarms,
there is no loss of information. Customers can drill down upon
the high-level alarm and still see the associated events that
made up the alarm. Customers can determine whether to sell
these correlation logics, give them away for free, or bundle
them with other products and services.
integration with hp OpenView operations
HP OpenView Operations offers event correlation on the
Operations management server as well as on supported HP
OpenView Operations managed nodes. This uniquely allows
distributed event correlation for systems, networks, applications
and database events.
For example, if a database server goes down, hundreds of
messages from dozens of applications can flood network and
management systems. ECS recognizes that all of the error
Page 2
messages are a result of the same database server going
down, and thereby reduces the number of messages to a single
message, immediately identifying the root of the problem.
What’s more, HP OpenView Operations can leverage alreadycorrelated
SNMP events by Network Node Manager to offer even
stronger distributed event correlation and therefore less network
traffic within Operations.
product requirements
hp hardware and software on network node manager 6.x
• HP 9000 Series 700/800, Solaris Ultra Servers or
Workstations, Windows NT ® Servers or Workstations
• HP-UX 10.20, 11.0 Sun Solaris 2.5.1, 2.6, Windows NT 4.0
• HP OpenView Network Node Manager 6.x
• Disk space: 45 MB
• RAM: 32 MB
hp hardware and software on hp OpenView operations 5.x
• HP 9000 Series 800
• HP-UX 10.20, 11.0
• HP OpenView Operations 5.x
• Additional Disk space: 45 MB
• Additional RAM: 32 MB
ordering information
This product is now integrated into current versions of Network
Node Manager and Operations. Product licensing and ordering
is only required for Network Node Manager 6.1 and earlier,
and Operations 6.x and earlier. See the ECS Designer product
datasheet for detailed ordering information for ECS Designer.
hp software services
For more information on HP software services available to
address your specific business needs, visit:
http://support.openview.hp.com/support_options.jsp.
for more information
For more information on HP OpenView, please contact your local
HP reseller or HP sales office.
Australia/New Zealand
+61 3 8877 4097
openview_events@hp.com
China +86 10 6564 3678
software_china@hp.com
Europe openview_ccc@hp.com
Hong Kong +85 2 2805 3551
software_solutions@hp.com
India +91 11 690 6176
software_india@hp.com
Japan +81 3 3331 6111
Korea +82 2 2199 0913
software_korea@hp.com
Malaysia +603 2698 6555
software_malaysia@hp.com
Philippines +63 2 894 1451
Singapore +65 6275 3888
software_singapore@hp.com
Taiwan +886 2 2712 0404
software_taiwan@hp.com
Thailand +662 661 3900
United States of America
1-877-OV-OWNER
Or visit:
www.openview.hp.com
© Copyright Hewlett-Packard Company 2003. All Rights Reserved.
Reproduction, adaptation or translation without prior written permission
is prohibited except as allowed under the copyright laws.
Windows NT is a U.S. registered trademark of Microsoft Corporation.
5981-6076EN February 2003