Since the Greeks, the saying “beauty is in the eye of the beholder” has been allegorical to almost anything from wine to sports cars — correlation is no exception.  Why is this? In my humble opinion, it’s because correlation is all about event reduction and event enrichment to reduce resolution times.   Event reduction boosts productivity so that operators can focus on problems before they become outages, fixing issues as soon as possible.   Correlation quality is so variable because most methods are not applicable to all environments.  Custom correlation tends to be the most valuable.   I also find it is difficult to quantify because it’s not usually a visual feature set.  You see it by tracking your operational metrics or reviewing behavior in the trenches or even measuring the accuracy of the reporting from your operators to your executives/customers.  The varying features, methods, and techniques are what makes correlation so confusing.

In my opinion, correlation is problematic for operations because they view it as a “one-and-done” project.    I think correlation is best when it is introduced to the incident management process.   Below is where I believe correlation should exist.

• New outage/problem/issue experienced
• Post-mortem executed – every time
• Knowledge recorded – if it can happen again
• Repeat offender captured – if happens more than occasionally
• Correlation policy created to gain productivity – if happens regularly/predictably
• Automatic Remediation policy created – if it happens frequently and is easy to fix

Again, I am of the opinion that getting the most value out of your correlation technologies  depends upon two things:  the flexibility of your correlation engine(s) and whether there is a process defined to allow your organization to grow your correlation capabilities.

As always, let me know what you think as I plan to write a white paper on this subject.

Find out more with our datasheets.

Technorati Tags:
monitoring, network monitoring, environmental monitoring, correlation, environmental correlation, monolith software, telcom monitoring, enrichment, performance monitoring, availability monitoring, application monitoring, automatic remediation, event enrichment, event reduction, operational metrics