Correlating against a large number of alarms within a 24h window

89 viewsalarm correlation Correlation rules
4
2 Comments

We are configuring a correlation rule that triggers when a situation occurs 3 times within 24 hours.

With a 24h window, up to 404 alarms can be included in the correlation.

Are there any risks, performance concerns, or correlation inaccuracies to consider when correlating against such a large number of alarms within a 24h window?

Henri Martins [DevOps Advocate] Posted new comment
Miguel Obregon [SLC] [DevOps Catalyst] commented

Hi Jordy,
Can you elaborate a bit more about 'up to 404 alarms can be included in the correlation'? Based on the screenshot, they are not collected (the option 'Immediate evaluation' is selected). Are you grouping the alarms?
Henri Martins [DevOps Advocate] commented

Hi. Thank to Jordy to have ask for me.
The correlation is not done for the moment. I think we will group alarms at least by element. These 404 alarms could be more than 10000 (start/stop) by day and by element in 24h.
I'm thinking about problems like large alarm trees.