Change of trigger status is the most frequent and most important source of events. Each time the trigger changes its state, an event is generated. The event contains details of the trigger state's change - when it happened and what the new state is.
Two types of events are created by triggers - Problem and OK.
A problem event is created:
An OK event closes the related problem event(s) and may be created by 3 components:
Triggers have an 'OK event generation' setting that controls how OK events are generated:
Additionally triggers have an 'OK event closes' setting that controls which problem events are closed:
Event correlation (also called global event correlation) is a way to set up custom event closing (resulting in OK event generation) rules.
The rules define how the new problem events are paired with existing problem events and allow to close the new event or the matched events by generating corresponding OK events.
However, event correlation must be configured very carefully, as it can negatively affect event processing performance or, if misconfigured, close more events than intended (in the worst case even all problem events could be closed). A few configuration tips:
If the 'Allow manual close' setting is enabled for trigger, then it's possible to manually close problem events generated by the trigger. This is done in UI during event acknowledgement. The event is not closed directly – instead a 'close event' task is created, which is handled by the task manager shortly. The task manager will generate a corresponding OK event and the problem event will be closed.