We currently use a correlation rule to generate fast alerts when dual source outages occur for a given service, which works well.
Separately, we have a more relaxed threshold in place that triggers a single source outage alert when only one source fails. However, this can lead to noisy or redundant alerts, especially in scenarios where the dual source outage has already been detected.
I’m looking to create a new correlation rule or modify the existing logic so that:
- If a dual source outage alert has already been raised for a specific service,
- Then any subsequent single source outage alert (for that same service and timeframe) — for either source — is suppressed or blocked.
This would help streamline incident visibility and reduce alert fatigue.
Has anyone implemented logic like this in DataMiner using correlation rules before? I’m open to suggestions or example configurations if available.
Added screenshot mentioned in comments below showing missing services entry for the Source(s) for service are down alarm. Same table as the other alarms.
Hi Sabastian,
I hadn't thought about handling this as a condition. Let me test this out next week and I'll post the configuration. I'll let you know. Thanks.
I tried using an alarm-template condition to block single-source alerts when a dual-source outage is active. In my setup, that approach didn’t work. While testing my correlation rules, I noticed another problem: I group alerts by Service, but the “Source(s) for server are down” alarms don’t show any Service link, so they don’t get grouped as expected. See attached screenshot.
Environment
Driver version: 1.2.1.8
Planning to test: 1.3.0.1 to see if the behavior is the same
Hi Joe,
I see that this question has been inactive for some time now. Have you been able to resolve this based on Sebastian's suggestion? If yes, could you post an answer of your own for reference for other users, or else select this answer so this question is closed and it's clear no further follow-up is needed?
Sorry I've been tied up on some other issues. I'll focus some time on this today and will post my results.
Hi Joe,
Would a condition in the alarm template help? See: https://docs.dataminer.services/dataminer/Operator_guide/Protocols_and_templates/Alarm_templates/Configuring_alarm_templates/Using_conditions_in_an_alarm_template.html
I'm thinking the single source outage alarm can be configured so it gets alarmed only if the dual source has a specific value (i.e. a value that does not represent an alarm)