Hello, I figure I'd share this since it somewhat helps me in my day to day in fixing broken CI's that have correlated to the wrong device. This is a "cross your fingers and hope it works" way to fix these situations within SOI.
So what i need to do is:
- Find the broken CI within SOI. You must find every instance of this CI. If it is modeled you must remove it from the service model it is found in. Usually you can r-click on the alert and if its modeled it will have a Location > sub menu entry available. Go into that service where it exists, Edit the service and remove the broken CI.
- Do this is all services it exists in.
- Also check if there are any active alerts currently on the console associated to this CI. If there is, you must clear them as well and not have any existing links to this CI present.
- Log into the SOI Web Page and then launch into its "USM Web View", usually http://<IP>:7070/ssaweb/home
- Enter the host in the search bar and when it pops up select the entry for the device.
- Under the USM Properties section, there is a "Correlate" link. Click this.
- Then on the "Correlating with: XXXX" page there is a "Re-correlate this entry" button.
- Click this button and cross your fingers.
This usually, if everything is cleaned up correctly within SOI, fixes the correlation issue. If it does not, re-check all possible instance and if any alerts popped into SOI.
If this still didn't' fix it, then check this CI within the Domain Manager to make sure its properties are accurate.
Other option:
Another option to try is, if you can, remove/delete the broken device from the domain manager. Run thru the re-correlate function above, then re-discover, re-create it in the DM and within in a few minutes it should be picked up correctly as new. You will loose all the "Cleared Alert History" entries on the device your performing these steps on btw.