Correlation Buckets: MATCH with label no change

Solved862 viewsbuckets Correlation match no change
2
0 Comments

Hi, all!

Brief query, you know why in the SLCorrelation there are events that after the MATCH legend add the label no change as shown in the following screenshot:

Because sometimes this correlation is not executing the actions defined, which is to execute a script and there are a couple of correlations similar to this one that do not log the label: no change.

I hope you can help me with this concern.

Regards

Christhiam Aaron Calatayud Franco [DevOps Advocate] Selected answer as best 4th August 2021

1 Answer

0
1.12K 1 Comment

Hi,

Alarms that get processed by the correlation engine end up in different buckets based on the filter and alarm grouping.  When an alarm for a bucket gets processed, the "condition" gets evaluated.  After successful evaluation of the condition you see either:

  • ===== MATCH ======= : the condition of the bucket is met due to this last event.  (So the condition was until this event not fulfilled)
  • ====== MATCH ======= [no change] : the condition of the bucket is met, but the state of the condition did not change due to this last event. (so the condition was already met before this event)

Regards

Christhiam Aaron Calatayud Franco [DevOps Advocate] Selected answer as best 4th August 2021
Christhiam Aaron Calatayud Franco [DevOps Advocate] commented

Thank you very much for the clarification
Regards