Hi Dojo,
I have a staging correlation set-up to generate a \”Critical\” correlated alarm.
All fine, except that with the current settings I have the impression to create some false positives: (Immediate Evaluation / Situation to occur 8 times in 5 minutes).
I believe this is due to the same parameter going in & out of the alarm range too many times within the 5 minutes sliding window, where, instead, the correlated alarm should be triggered only when all the rows in the element table present the minor \”base\” severity:
Only-when-ALL.JPG
Ideally, I’d define a “Boolean” variable to be TRUE only if all the base parameters have all the required active severity, but I’m not sure this is currently possible within the “aggregation” settings
{Please see this older post}: is this possible by running a script that will basically act as a trigger?
And if so, how is the script triggered as part of a rule condition rather than the action?
May not make a big difference, but keen to better understand the UI:
I’m adding this post hoping to get some suggestions for a recommended approach.
If the BOOLEAN cannot be defined, shall I opt for \”Collect Events for 20 seconds\” and then apply some sort of Condition –> can this be used to count the 8 different alarms for the same element?
Thanks
As this question has now been inactive for a long time, I will close it. If you still want more information about this, could you post a new question?
Hi Alberto,
There’s more information about the available script conditions here: Condition format | DataMiner Docs and here: Script condition functions | DataMiner Docs
Unfortunately, there is no option available to run a custom script. The functions available are doing simple operations on the properties of the alarm event(s) involved. The wildest you can go is fetching a live parameter value of an element.
You’ve lost me a bit on what you’re trying to achieve though. As far as I gather you are trying to do a sliding window rule but something about the generated correlation alarm is unexpected
Thanks for the feedback Wouter, will check these links asap – indeed since posting the question, the logic has evolved into considering immediate or persisting events, but only if all the ROWs of the table present the alarm at the same time: this to see if this can help reducing false positives (e.g, when the same row goes in & out of alarm thus incrementing the count – the counter is going to be 8 in total, but needs to be from different rows, can’t include cases where the 8 is reached by 4 rows going in alarm twice).
The challenge is to make sure that even a short ALL rows in alarm (as long as detectable with the related polling) is always triggering the correlation.
I’m also looking into a way to trigger a script that could be used to check if the rows are actually “all in alarm” and then re-correlate – may need to check with our support squad.
I see that this question has been inactive for some time. Do you still need help with this? If not, could you select the answer (using the ✓ icon) to indicate that the question is resolved?