Learn about child event frame generation with multiple start triggers

PI Analysis Service can capture child event frames. Child event frames are useful when you need to send escalating notifications or perform an in-depth analysis of the past events. This topic discusses the following:

• Video that shows you how to configure event frames with multiple start triggers

• Effective start triggers

• Example of child event frame generation

  Note: This topic is only applicable to the explicit trigger.

Video

For information on setting up event frames with multiple start triggers and severities, watch this video:

Effective start triggers

Event frame generation analysis supports multiple start triggers. When triggering an analysis, the effective start trigger is determined by taking the following three things into account: trigger evaluation, severity and order of the triggers.

• Evaluation

  If only one start trigger is True, then that is the effective start trigger. If multiple start triggers evaluate to True, then the analysis must take severity into account.

• Severity

  If the multiple start triggers evaluate to True, the one with the highest severity level is the effective start trigger. For example, if there are two start triggers, StartTrigger1 with severity Major and StartTrigger2 with severity Critical, and they both evaluate to True at the same point in time, then StartTrigger2 is considered the effective trigger as it has the higher severity.

  Note: Severity levels in decreasing order of magnitude are: Critical, Major, Minor, Warning, Information and None (default).

• Order

  If multiple start triggers with the same severity evaluate to True, then the start trigger defined first is the effective start trigger.

In the end, there is only one effective start trigger.

Child event frame generation due to change in the effective start trigger

An analysis with multiple start triggers may automatically create child event frames. For example, an event frame generation analysis would complete the following steps:

1. A start trigger evaluates to True and there is no open event frame. The analysis starts an event frame.

2. In a subsequent evaluation, while the event frame is still open, the effective start trigger does not change and continues to evaluate to True. Then the event frame will remain open.

3. Another evaluation causes the effective start trigger to be different than step 1. This causes the analysis to do the following:

   1. Start a new parent event frame with the same start time as the original event frame.

   2. Make the original event frame a child of this new parent event frame.

   3. Close the original event frame (now a child event frame).

   4. Create a new child event frame with the new effective start trigger.

4. Another evaluation does not cause the effective start trigger to change. The analysis keeps both the child and the parent event frames open.

5. Another evaluation causes the effective start trigger to change again. Then:

   5. The child event frame created in 3d closes.

   6. Yet another child event frame is created by this new effective start trigger.

6. Another evaluation causes all of the start triggers to be False. Then:

   7. Child event frame created in 5b closes.

   8. Parent event frame created in 3a closes.