Notification differences between IsRoot and IsProblem attribute for root cause analysis
search cancel

Notification differences between IsRoot and IsProblem attribute for root cause analysis

book

Article ID: 332112

calendar_today

Updated On:

Products

VMware Smart Assurance

Issue/Introduction

To understand the usage of isRoot and isProblem attribute for root cause analysis (RCA).

Environment

10.x

Resolution

The main difference is that the IsProblem is determined by underlying Domain Manager and IsRoot is determined by Global Manager.

1, IsRoot set to Yes - means that after correlating a particular notification received from underlying domain, SAM has determined that the notification is a root-cause problem. When Set to No, after correlating the notification SAM determines it to be NOT a root cause problem. A notification cannot be a problem unless the IsProblem attribute is set to Yes, else it's just an event.
 
2, IsProblem set to Yes - means that the underlying domain that created/sent the notification has marked it has as a root-cause problem. If No, then the underlying domain has marked it has an event.
 
3, IsRoot is determined by Global Manager, while IsProblem is determined by the underlying domain that created the notification

 
IsRoot
IsProblem
Meaning
Yes
 
After correlating this notification with notifications received from other underlying Domain Managers, the Global Manager has determined that this notification is a root-cause problem
No
 
After correlating this notification with notifications received from other underlying Domain Managers, the Global Manager has determined that this notification is not a root-cause problem.
 
Yes
The underlying Domain Manager that created this notification has marked this notification as a root-cause problem.
 
No
The underlying Domain Manager that created this notification has marked this notification as an event.
(1) *Determined by the Global Manager
(2) Determined by the underlying Domain Manager that created the notification.

4, When both IsProblem and IsRoot are Set to Yes - this tells us that the notification is a problem diagnosed by the underlying domain manager
 
5, When IsProblem is No and IsRoot Yes - This tells us that the notification is an event originating from the managed network forwarded by the underlying domain manager to global manager.
 
6, When both are set to No - tells us that this particular notification is either a impact event or informational event from underlying domain, originated from the managed network and forwarded by that underlying domain to  global manager.
 
7, So basically, IsProblem attribute set to Yes, confirms that a notification is a root-cause problem.

 
IsRoot
IsProblem
Meaning
Yes
Yes
Indicates that this notification is a problem diagnosed by an underlying Domain Manager.
Yes No
Indicates that this notification is an event originating from the managed network and forwarded by an underlying Domain Manager to the Global Manager
No
No
Indicates that this notification is either an impact event generated by an underlying Domain Manager or an informational event originating from the managed network and forwarded by the underlying Domain Manager to the Global Manager 

Example: an IP domain sends a notification to SAM and has;
 
a, The attribute IsProblem set to Yes, means that the notification is a problem from the managed network deemed a root-cause problem by IP Manager
 
b, The attribute IsRoot is set to Yes, means that the notification is an event from IP Manager deemed a root-cause problem by SAM
 
c, When both attributes are set to NO, the notification is only an impact event or an informational event from IP manager to SAM