Correlate Alarms by Element Name

Solved1.37K viewsalarms Correlation rules
0
0 Comments

I have applied this filter on alarms with a specific alarm ID and then correlating these alarms on a per element basis. However looking at the output we see multiple alarms per element which haven’t correlated.

Below is the rule that has been added.

as requested by Michaël I have attached the actions.

Marieke Goethals [SLC] [DevOps Catalyst] Selected answer as best 11th July 2023

2 Answers

0
6.02K 0 Comments

Hi Ryan,

Since you’re grouping per element anyway, I’d advise to leave the “correlate across DMAs” checkbox unchecked. (all alarm events that need to be grouped together are originating from the same element/agent)

This correlation rule is supposed to combine all of the simultaneously active *34003* alarms for an element together in one correlated alarm event on that same element. I’m not seeing any obvious configuration errors in the screenshots.

Marieke Goethals [SLC] [DevOps Catalyst] Selected answer as best 11th July 2023
0
1.79K 3 Comments

Hi Ryan,

At first sight I don’t see anything wrong with the correlation rule. Is it possible to add a screenshot of the “Actions” section of your correlation rule as well as a screenshot of the alarms which are not correlated?

ryan yahia Edited comment 19th November 2021
ryan yahia commented

Hi Michaël,

As requested I have attached a screenshot of the Actions and the alarms in the main questions.

Thanks,
Ryan
Michaël Pincket [SLC] [DevOps Advocate] commented

Hi Ryan,

Thanks for the additional information.

I think there can be two reasons why the rule is not triggered :

* The alarms do not match the alarmfilter you have entered in the correlation rule. This wouls mean that the alarms don’t contain “34003” in their parameterdescription.

* The DMA you selected to handle the correlation rule is not running.

Could you check if one of the above reasons is the cause for your issue?
ryan yahia commented

Hi Michaël,

Apologies the example I gave is for Alarms 34008, but the same behaviour exists for alarms with identity with 34003.

With the second point if the dma is not running for a period of time will the rule be automatically applied after it is. I have checked on the machine and the dma is running.