Introducing a Time Delay

As mentioned previously, Incident Manager RCA is an iterative process whereby incoming target down events are continually being evaluated, resulting in updates to causal analysis states. Over a period of time (minutes), a root cause may or may not remain a root cause depending on incoming target down events. The original target down event may later be classified as a symptom. To allow time for target down events to be reported, analyzed, and then acted upon (such as creating an incident), you can define an event evaluation time delay when creating a rule set.

In the previous example, where incidents are created for non-symptom events, without a time delay in the rule, there could potentially be an incident created for a non-symptom event that eventually becomes a symptom.

To add a time delay to the rule:

  1. From the Create Rule Set wizard Add Actions page, click Add or Edit (modify an existing rule). The Add Conditional Actions page displays.
  2. In the Conditions for Actions region, choose Only execute the actions if specified conditions match. A list of conditions displays.
  3. Choose Event has been open for specified duration.
  4. Specify the desired time delay.
  5. Click Continue and complete the remaining steps in the wizard.